CVE-2024-45590 body-parser vulnerable to denial of service when url encoding is enabled
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-45590?
CVE-2024-45590 is a high-severity vulnerability in expressjs body-parser, published on 10 Sep 2024.
Official description
body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.
Weakness: CWE-405
Which versions are affected by CVE-2024-45590?
2 open source packages ship an affected version, including body-parser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
body-parser npm | All versions | 1.20.3 |
body-parser npm | All versions | 1.20.3 |
Products include Openjsf Body-Parser.
How do I fix CVE-2024-45590?
Upgrade body-parser to 1.20.3 or later.
Is CVE-2024-45590 being exploited?
There is no known exploitation of CVE-2024-45590 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in expressjs body-parser
Sources
Also known as AZL-49071, AZL-49097, AZL-49126, AZL-49149, CLSA-2026-1772583201, CLSA-2026-1773793044 and 11 more.