Express Ships a body-parser Fix for a Request DoS. Upgrade Now.
Express bumped body-parser to 2.4.0 to fix CVE-2026-111181, a denial of service where trailing bytes after a compressed request body crash the process. Here's what happens and how to spot it.