Skip to content

chore(deps): update dependency body-parser to v1.20.3 [security]#186

Merged
renovate[bot] merged 1 commit intomainfrom
renovate/npm-body-parser-vulnerability
Apr 20, 2025
Merged

chore(deps): update dependency body-parser to v1.20.3 [security]#186
renovate[bot] merged 1 commit intomainfrom
renovate/npm-body-parser-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Sep 16, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
body-parser 1.20.0 -> 1.20.3 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-45590

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References


Release Notes

expressjs/body-parser (body-parser)

v1.20.3

Compare Source

===================

  • deps: qs@6.13.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

v1.20.2

Compare Source

===================

  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
    • perf: skip value escaping when unnecessary
  • deps: raw-body@2.5.2

v1.20.1

Compare Source

===================

  • deps: qs@6.11.0
  • perf: remove unnecessary object clone

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the deps label Sep 16, 2024
@renovate renovate Bot requested a review from mathe42 September 16, 2024 07:32
@renovate renovate Bot force-pushed the renovate/npm-body-parser-vulnerability branch from 5cddd7c to fc3a54e Compare November 30, 2024 22:56
@renovate renovate Bot force-pushed the renovate/npm-body-parser-vulnerability branch from fc3a54e to ec37ac8 Compare April 19, 2025 23:00
@renovate renovate Bot merged commit 36e3268 into main Apr 20, 2025
1 check passed
@renovate renovate Bot deleted the renovate/npm-body-parser-vulnerability branch April 20, 2025 01:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant