CVE-2024-45590: high-severity vulnerability in expressjs body-parser
body-parser vulnerable to denial of service when url encoding is enabled
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
body-parser, a Node.js library that processes incoming request data, can be exploited to crash or slow down a server when URL encoding is enabled. An attacker can send specially crafted requests that consume excessive server resources, making the service unavailable to legitimate users.
body-parser versions prior to 1.20.3 are vulnerable to denial of service via malicious URL-encoded payloads. The vulnerability is triggered when the URL encoding parser processes crafted input, consuming excessive CPU or memory resources. Attackers can exploit this by sending multiple specially crafted requests without authentication, causing service degradation or unavailability.