body-parser

Draft: needs live access. body-parser 2.3.0 → 2.4.0. Tests that call real services cannot run in the sandbox (network off).

Why this repo

body-parser 2.3.0 is a direct dependency and is in the vulnerable range of:

• GHSA-27r3-jxmh-p828 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body (high). GHSA-27r3-jxmh-p828, CVE-2026-111181. Fixed in 2.4.0, 1.20.9.

The advisories name no function to look for, so Teire cannot rule out that your code reaches the vulnerable path.

What changed upstream

Comparing the public API of 2.3.0 and 2.4.0: body-parser: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body.

More from upstream

Commits between 2.3.0 and 2.4.0:

• b4744d7 2.4.0 (expressjs/body-parser#777)
• f7075ea fix: prevent process crash from trailing bytes after a compressed body
• 185ff1d chore: update dependencies (expressjs/body-parser#778)
• 73713f7 docs: fix depth error description (expressjs/body-parser#776)
• 2dcc826 docs: improve readability (expressjs/body-parser#756)
• 402dbdc docs: note that req.body may be undefined in v2 (expressjs/body-parser#752)
• 9883a1e perf: inline content stream setup (expressjs/body-parser#750)
• 02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (expressjs/body-parser#773)
• 822a0fd build(deps): bump the github-actions group with 3 updates (expressjs/body-parser#771)
• aa9889b ci: trigger npm publish on release published and set dist-tag (expressjs/body-parser#768)

compare the versions

Changes

File	Change
package-lock.json	2.3.0 → 2.4.0
package-lock.json	regenerated by npm (+10/−8 lines)

Verification

Each side installed its own lockfile in its own sandbox (Token Factory Sandboxes, a microVM per command; the install had the network, the checks had no network interface).

Check	Before (2.3.0)	After (2.4.0)
build npm run -s build	✓ exit 0	✓ exit 0
test npm run -s test:vitest:unit -- --reporter=default --reporter=json --outputFile.j	✗ exit 1 · 1698/1700 passed, 2 failed	✗ exit 1 · 1698/1700 passed, 2 failed
typecheck npx --no-install tsc --noEmit -p tsconfig.json	✗ exit 2 · 120 type errors	✗ exit 2 · 120 type errors

Evidence: needs live access. test, typecheck failed on the baseline too, and no worse after the change; the failing checks need the network.

Receipt

Step	Model	Tokens in / out	Cost
Review of the dependency change: nothing needs a person	NVIDIA Nemotron 3 Ultra	411 / 558	$0.0021
Sandboxes: install + checks, both sides	Token Factory Sandboxes	—	301 s

Model total: $0.0021.

Risks not covered

• test, typecheck failed on the baseline too, and no worse after the change; the failing checks need the network

• Lint, end-to-end and integration suites were not run; dependencies were installed without lifecycle scripts.

Rollback

Revert this pull request: every file listed under Changes returns to body-parser 2.3.0.

Commands

@teire rebase · @teire recreate · @teire explain · @teire ignore body-parser

_{Teire · live run · NVIDIA Nemotron 3 Ultra on Nebius Token Factory}