body-parser vulnerable to denial of service when url encoding is enabled

published 2024-09-10 2 y ago modified 2026-09-10 1 mo ago also GHSA-qwcr-r2fm-qrc7 , EUVD-2024-2860

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits: 0; none known

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Patch / fix

fixed in 2 distros 2 links 1

npm body-parser 1.20.3
expressjs body-parser 1.20.3

debian azure linux

node-body-parser Debian 14, Debian 13 1.20.3+~1.19.5-1

debian advisories DEBIAN-CVE-2024-45590

python-tensorboard Azure Linux 3.0 2.16.2-5
reaper CBL-Mariner 2.0 3.1.1-13

azure linux advisories AZL-49071 AZL-49126

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/expressjs/body-parser@b2695c4 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-45590 updated 2026-11-04 cvss 7.5

body-parser: Denial of Service Vulnerability in body-parser

Red Hat Cryostat 3 body-parser
affected: workaround, no fix available
Red Hat Migration Toolkit for Applications 7 mta/mta-ui-rhel9, mta/mta-cli-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat Migration Toolkit for Runtimes body-parser
affected: workaround, no fix available
Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift Lightspeed lightspeed-console-plugin-rhel9
affected: workaround, no fix available
Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenShift Serverless body-parser
affected: workaround, no fix planned “Will not fix”
Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7
affected: workaround, no fix available

show 26 more

Red Hat Ansible Automation Platform 2 aap-cloud-ui-container, ansible-automation-platform-25/lightspeed-rhel8
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat build of OptaPlanner 8 body-parser Red Hat Data Grid 8 body-parser
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 thunderbird
affected: workaround, no fix planned “Out of support scope”
Red Hat Fuse 7 body-parser Red Hat Integration Camel K 1 body-parser Red Hat OpenShift Container Platform 3.11 openshift3/ose-console Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-networking-console-plugin-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8
affected: workaround, no fix available
Red Hat OpenShift Data Science (RHODS) rhods/odh-dashboard-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift distributed tracing 3 rhosdt/tempo-jaeger-query-rhel8
affected: workaround, no fix available
Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Process Automation 7 body-parser
affected: workaround, no fix planned “Will not fix”
Red Hat Quay 3 quay/quay-rhel8
affected: workaround, no fix available
Red Hat Discovery 1 for RHEL 9 discovery/discovery-ui-rhel9 1.12.0-1, discovery/discovery-server-rhel9 1.12.0-1
fixed: vendor fix RHSA-2025:1249
Red Hat NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9 v1.7.0-67, network-observability/network-observability-operator-bundle 1.7.0-86, network-observability/network-observability-rhel9-operator v1.7.0-67, network-observability/network-observability-ebpf-agent-rhel9 v1.7.0-67, network-observability/network-observability-console-plugin-rhel9 v1.7.0-67, network-observability/network-observability-flowlogs-pipeline-rhel9 v1.7.0-67
fixed: vendor fix RHSA-2024:8014
Red Hat Developer Hub (RHDH) 1.4 rhdh 1.4-1734106454
fixed: vendor fix RHBA-2024:11265
Red Hat Developer Hub 1.3 for RHEL 9 rhdh/rhdh-hub-rhel9 1.3-124
fixed: vendor fix RHBA-2024:9054
Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 v1.8.5-7
fixed: vendor fix RHSA-2024:10906
Red Hat OpenShift AI 8 rhoai/odh-rhel8-operator v2.13.1-2, rhoai/odh-dashboard-rhel8 v2.13.1-1, rhoai/odh-modelmesh-rhel8 v2.13.1-1, rhoai/odh-operator-bundle v2.13.1-2, rhoai/odh-mm-rest-proxy-rhel8 v2.13.1-1, rhoai/odh-kueue-controller-rhel8 v2.13.1-1, +24 more
fixed: vendor fix RHBA-2024:8413
Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9 v4.17.0-202501301204.p0.gcffdc60.assembly.stream.el9
fixed: vendor fix RHSA-2025:0875
Red Hat OpenShift Container Platform 4.18 openshift4/metallb-rhel9 v4.18.0-202502041632.p0.gdcee704.assembly.stream.el9, openshift4/ose-ptp-rhel9 v4.18.0-202501230001.p0.gcc2e8c8.assembly.stream.el9, openshift4/rdma-cni-rhel9 v4.18.0-202501230001.p0.g36ae553.assembly.stream.el9, openshift4/sriov-cni-rhel9 v4.18.0-202501230001.p0.g150a2eb.assembly.stream.el9, openshift4/ose-dpu-cni-rhel9 v4.18.0-202501230001.p0.g99f3e30.assembly.stream.el9, openshift4/ose-dpu-daemon-rhel9 v4.18.0-202501230001.p0.g99f3e30.assembly.stream.el9, +47 more
fixed: vendor fix RHSA-2024:6121
Red Hat OpenShift distributed tracing 3.4 rhosdt
fixed: vendor fix RHSA-2024:10917
Red Hat OpenShift GitOps 1.12 openshift-gitops-1/dex-rhel8 v1.12.6-2, openshift-gitops-1/argocd-rhel8 v1.12.6-2, openshift-gitops-1/argocd-rhel9 v1.12.6-1, openshift-gitops-1/gitops-rhel8 v1.12.6-2, openshift-gitops-1/must-gather-rhel8 v1.12.6-2, openshift-gitops-1/kam-delivery-rhel8 v1.12.6-2, +4 more
fixed: vendor fix RHSA-2024:8677
Red Hat OpenShift GitOps 1.13 openshift-gitops-1/dex-rhel8 v1.13.2-4, openshift-gitops-1/argocd-rhel8 v1.13.2-4, openshift-gitops-1/argocd-rhel9 v1.13.2-5, openshift-gitops-1/gitops-rhel8 v1.13.2-4, openshift-gitops-1/must-gather-rhel8 v1.13.2-4, openshift-gitops-1/kam-delivery-rhel8 v1.13.2-4, +4 more
fixed: vendor fix RHSA-2024:8581
Red Hat Trusted Profile Analyzer 1.2 rhtpa 1.2.0-1730813392, rhtpa 1.2.0-1730929100
fixed: fixed in 1.2.0 RHSA-2024:9885
Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.6-2
fixed: vendor fix RHSA-2024:9583
Red Hat RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.5.5-3
fixed: vendor fix RHSA-2024:10186
Red Hat RHODF 4.14 for RHEL 9 odf4/odf-console-rhel9 v4.14.18-3, odf4/ocs-client-console-rhel9 v4.14.18-2, odf4/odf-multicluster-console-rhel9 v4.14.18-2
fixed: vendor fix RHSA-2025:8551
Red Hat RHODF 4.15 for RHEL 9 odf4/odf-console-rhel9 v4.15.14-2, odf4/ocs-client-console-rhel9 v4.15.14-2, odf4/odf-multicluster-console-rhel9 v4.15.14-2
fixed: vendor fix RHSA-2025:8544
Red Hat RHODF 4.16 for RHEL 9 odf4/mcg-core-rhel9 v4.16.3-1, odf4/odf-console-rhel9 v4.16.10-4, odf4/ocs-client-console-rhel9 v4.16.10-4, odf4/odf-multicluster-console-rhel9 v4.16.10-3
fixed: vendor fix RHSA-2024:8113

4 more fixed, 29 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-09-10)

Exploit prediction

0.82% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	body-parser	<1.20.3	1.20.3

Affected products

expressjs body-parser

Classification

Weakness

CWE-405 Asymmetric Resource Consumption (Amplification)

References

github.com /expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce
web, patch
github.com /expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2024-45590
advisory
github.com /expressjs/body-parser
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary