Is body-parser 1.13 vulnerable?
npm · 4 releases from 1.13.0 to 1.13.3 · latest body-parser is 2.4.0 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. body-parser 1.13.3, the last 1.13 release, is affected by 3 known security advisories (2 high, 1 low), including CVE-2026-111181, CVE-2024-45590, CVE-2026-12590. Upgrade to 1.20.9 or later to fix all of them.
npm install body-parser@1.20.9Advisories affecting body-parser 1.13.3
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
- Affected
- >=2.0.0 <2.4.0 · <1.20.9
- Fixed in
- 1.20.9, 2.4.0
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
- Affected
- <1.20.6 · >=2.0.0 <2.3.0
- Fixed in
- 1.20.6, 2.3.0
body-parser vulnerable to denial of service when url encoding is enabled
- Affected
- <1.20.3
- Fixed in
- 1.20.3
Which of your client projects are still on body-parser 1.13?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact body-parser version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other body-parser versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.