CVE-2024-45590 HIGH

CVE-2024-45590: body-parser vulnerable to denial of service when url encoding is enabled

Vendor Expressjs
Product body-parser
Weakness CWE-405
Published September 10, 2024
Last update September 10, 2024
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Key dates

02Disclosure timeline

September 10, 2024 CVE published
September 10, 2024 Record updated