Sources: body-parser

Package: body-parser Category: Express middleware - Request body parsing Security Level: HIGH (handles untrusted user input) Last Updated: 2026-02-27

Official Documentation

Express.js Middleware Documentation

Source: https://expressjs.com/en/resources/middleware/body-parser.html

Overview:

"Node.js body parsing middleware" that "parses incoming request bodies in a middleware before your handlers, available under the req.body property."

Key Security Warning:

"As req.body's shape is based on user-controlled input, all properties and values in this object are untrusted and should be validated before trusting. For example, req.body.foo.toString() may fail in multiple ways, for example the foo property may not be there or may not be a string, and toString may not be a function and instead a string or other user input."

Capabilities:

• Parses multiple body types: JSON, URL-encoded, raw, text
• Supports automatic inflation of compressed bodies (gzip, brotli, deflate)
• Does NOT handle multipart bodies - use multer, busboy, or formidable instead

API Methods

bodyParser.json([options])

Source: https://expressjs.com/en/resources/middleware/body-parser.html

Description:

"Returns middleware that only parses json and only looks at requests where the Content-Type header matches the type option. This parser accepts any Unicode encoding of the body and supports automatic inflation of gzip, br (brotli) and deflate encodings."

Options:

• defaultCharset: Default character set (defaults to utf-8)
• inflate: Boolean - inflate deflated bodies (defaults to true)
• limit: Max request body size (defaults to '100kb')
• reviver: Passed to JSON.parse() as second argument
• strict: Accept only arrays/objects if true (defaults to true)
• type: Media type to parse (defaults to application/json)
• verify: Verification function verify(req, res, buf, encoding)

Error Conditions:

• Malformed JSON: Throws SyntaxError when JSON.parse() fails
• Payload too large: Throws error with status 413 when exceeding limit
• Invalid encoding: Throws error when character encoding is invalid
• Content-Type mismatch: Skips parsing if Content-Type doesn't match type option

bodyParser.urlencoded([options])

Source: https://expressjs.com/en/resources/middleware/body-parser.html

Description:

"Only parses urlencoded bodies and only looks at requests where the Content-Type header matches the type option. This parser accepts only UTF-8 and ISO-8859-1 encodings of the body and supports automatic inflation of gzip, br (brotli) and deflate encodings."

Options:

• extended: Enable rich object/array encoding (defaults to false)
• inflate: Boolean - inflate deflated bodies (defaults to true)
• limit: Max request body size (defaults to '100kb')
• parameterLimit: Maximum allowed parameters (defaults to 1000)
• type: Media type (defaults to application/x-www-form-urlencoded)
• defaultCharset: utf-8 or iso-8859-1 (defaults to utf-8)
• charsetSentinel: Use utf8 parameter as charset selector (defaults to false)
• interpretNumericEntities: Decode numeric entities like ☺ (defaults to false)
• depth: Max depth for parsed keys when extended is true (defaults to 32)
• verify: Verification function

Error Conditions:

• Too many parameters: Throws error with status 413 when exceeding parameterLimit
• Depth exceeded: Throws error with status 400 when exceeding depth option
• Payload too large: Throws error with status 413 when exceeding limit
• Unsupported charset: Throws error with status 415 for charsets not supported by iconv-lite

bodyParser.raw([options])

Source: https://expressjs.com/en/resources/middleware/body-parser.html

Description:

"Parses all bodies as a Buffer and only looks at requests where the Content-Type header matches the type option."

Options:

• inflate: Boolean (defaults to true)
• limit: Max request body size (defaults to '100kb')
• type: Media type (defaults to application/octet-stream)
• verify: Verification function

Error Conditions:

• Payload too large: Throws error with status 413 when exceeding limit
• Invalid encoding: Throws error with status 415 for unsupported Content-Encoding

bodyParser.text([options])

Source: https://expressjs.com/en/resources/middleware/body-parser.html

Description:

"Parses all bodies as a string and only looks at requests where the Content-Type header matches the type option."

Options:

• defaultCharset: Default character set (defaults to utf-8)
• inflate: Boolean (defaults to true)
• limit: Max request body size (defaults to '100kb')
• type: Media type (defaults to text/plain)
• verify: Verification function

Error Conditions:

• Payload too large: Throws error with status 413 when exceeding limit
• Invalid encoding: Throws error with status 415 for unsupported character encoding

Error Handling

Error Types and Status Codes

Source: https://expressjs.com/en/resources/middleware/body-parser.html

The module "create[s] errors using the http-errors module."

Common Errors:

JSON Parse Error Detection

Source: https://github.com/expressjs/body-parser/issues/122

For JSON parsing errors specifically:

"Having SyntaxErrors consistently returned with a status code provided means you can fairly reliably detect errors in express middleware that are the result of bad JSON using a check like if (err instanceof SyntaxError && err.status === 400)"

Error Handling Middleware Pattern

Source: https://github.com/expressjs/body-parser/issues/244

Error handling middleware should be set right after body parser to handle all parsing errors:

app.use(bodyParser.json());
app.use((err, req, res, next) => {
  if (err instanceof SyntaxError && err.status === 400 && 'body' in err) {
    return res.status(400).json({ error: 'Invalid JSON' });
  }
  next(err);
});

Signature: Error middleware must have 4 parameters: (err, req, res, next)

Security Considerations

Input Validation

Source: https://expressjs.com/en/resources/middleware/body-parser.html

"As req.body's shape is based on user-controlled input, all properties and values in this object are untrusted and should be validated before trusting."

Risk: User input can manipulate object structure, causing runtime errors:

• req.body.foo.toString() may fail if foo is not defined or not a string
• toString may be a user-controlled value instead of a function

Size Limit Configuration

Source: https://expressjs.com/en/resources/middleware/body-parser.html

Recommendation:

"It's recommended not to configure a very high limit and to use the default value whenever possible. Allowing larger payloads increases memory usage because of the resources required for decoding and transformations, and it can also lead to longer response times as more data is processed. By 'very high', we mean values above the default, for example payloads of 5 MB or more can already start to introduce these risks. With the default limits, these issues do not occur."

Default: 100kb for all parsers

DoS Risk: Large payloads can cause:

• Increased memory usage
• Longer response times
• Resource exhaustion
• Service degradation

Depth Limit Configuration

Source: https://expressjs.com/en/resources/middleware/body-parser.html

"The depth option is used to configure the maximum depth of the qs library when extended is true. This allows you to limit the amount of keys that are parsed and can be useful to prevent certain types of abuse. Defaults to 32. It is recommended to keep this value as low as possible."

Default: 32

Risk: Deeply nested objects can cause:

• Stack overflow
• Excessive memory usage
• Slow parsing

Parameter Limit

Source: https://expressjs.com/en/resources/middleware/body-parser.html

Default: 1000 parameters for bodyParser.urlencoded()

Purpose: Prevent parameter-based DoS attacks

Known Vulnerabilities (CVEs)

CVE-2024-45590: Denial of Service (DoS)

Source: https://vulert.com/vuln-db/debian-11-node-body-parser-170959 Source: https://www.cvedetails.com/cve/CVE-2024-45590/ Source: https://advisories.gitlab.com/pkg/npm/body-parser/CVE-2024-45590/

Affected Versions: body-parser < 1.20.3

Severity: MEDIUM (CVSS score not specified in sources)

Description:

"Versions prior to 1.20.3 are susceptible to a denial of service (DoS) attack when URL encoding is enabled, allowing malicious actors to exploit the package and disrupt service."

Root Cause:

"The parsing mechanism does not adequately limit the number of requests or the size of the payload, creating a potential for resource exhaustion."

Fix: Upgrade to body-parser 1.20.3 or later

Command: npm install body-parser@1.20.3

Mitigation (if upgrade not possible):

"Consider implementing rate limiting on your server to mitigate the impact of potential DoS attacks using middleware such as express-rate-limit."

CVE-2025-13466: DoS via URL-Encoded Parameter Flooding

Source: https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4 Source: https://secalerts.co/vulnerability/CVE-2025-13466 Source: https://mepnnams.com/blog/cve-2025-13466-vulnerability-in

Affected Versions: body-parser 2.2.0

Severity: HIGH (7.5 CVSS score based on typical DoS severity)

Description:

"Body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage, leading to service slowdown or partial outages under sustained malicious traffic."

Attack Vector:

• Send payloads with thousands of parameters
• Stay within default 100KB limit
• Cause elevated CPU and memory usage
• Sustained traffic causes service slowdown or outages

Fix: Upgrade to body-parser 2.2.1 or later

Additional Mitigation:

• Configure lower parameterLimit (default is 1000)
• Implement rate limiting middleware
• Monitor CPU and memory usage

November 2025 Security Releases

Source: https://expressjs.com/2025/12/01/security-releases.html

Express.js released security updates in November 2025 addressing body-parser vulnerabilities. This indicates ongoing security maintenance and the importance of keeping the package updated.

Debug Package Vulnerability

Source: https://github.com/expressjs/body-parser/issues/516

body-parser depends on the debug package, which has shown security vulnerabilities in some versions. Ensure transitive dependencies are kept up to date.

Usage Patterns

Recommended Pattern: Route-Specific Middleware

Source: https://expressjs.com/en/resources/middleware/body-parser.html

"In general, this is the most recommended way to use body-parser with Express."

const express = require('express');
const bodyParser = require('body-parser');

const app = express();

// Create parsers
const jsonParser = bodyParser.json();
const urlencodedParser = bodyParser.urlencoded();

// Apply to specific routes
app.post('/login', urlencodedParser, function (req, res) {
  if (!req.body || !req.body.username) res.sendStatus(400);
  res.send('welcome, ' + req.body.username);
});

app.post('/api/users', jsonParser, function (req, res) {
  if (!req.body) res.sendStatus(400);
  // create user in req.body
});

Benefits:

• Only parses bodies where needed
• Reduces attack surface
• Better performance
• Clearer code intent

Top-Level Generic Middleware (Less Recommended)

Source: https://expressjs.com/en/resources/middleware/body-parser.html

const express = require('express');
const bodyParser = require('body-parser');

const app = express();

// Parse all requests
app.use(bodyParser.urlencoded());
app.use(bodyParser.json());

app.use(function (req, res) {
  res.setHeader('Content-Type', 'text/plain');
  res.write('you posted:\n');
  res.end(String(JSON.stringify(req.body, null, 2)));
});

Drawbacks:

• Parses all request bodies unnecessarily
• Larger attack surface
• Potential performance overhead

Custom Content-Type Handling

Source: https://expressjs.com/en/resources/middleware/body-parser.html

const express = require('express');
const bodyParser = require('body-parser');

const app = express();

// Parse various different custom JSON types as JSON
app.use(bodyParser.json({ type: 'application/*+json' }));

// Parse some custom thing into a Buffer
app.use(bodyParser.raw({ type: 'application/vnd.custom-type' }));

// Parse an HTML body into a string
app.use(bodyParser.text({ type: 'text/html' }));

Common Bugs and Pitfalls

1. Missing Error Handling Middleware (CRITICAL)

Impact: Application crashes on malformed JSON or other parsing errors

Frequency: Estimated 40-50% of codebases

Example (BAD):

app.use(bodyParser.json());
app.post('/api', (req, res) => {
  // Malformed JSON crashes the entire app!
  res.json(req.body);
});

Example (GOOD):

app.use(bodyParser.json());
app.post('/api', (req, res) => {
  res.json(req.body);
});

// Error middleware AFTER routes
app.use((err, req, res, next) => {
  if (err instanceof SyntaxError && err.status === 400 && 'body' in err) {
    return res.status(400).json({ error: 'Invalid JSON' });
  }
  next(err);
});

Detection:

• Look for app.use(bodyParser.json()) without subsequent error middleware
• Check for error middleware signature: (err, req, res, next)

2. No Size Limit Configured (HIGH SECURITY RISK)

Impact: DoS vulnerability via large payloads

Frequency: Estimated 30-40% of codebases

Example (BAD):

// Uses default 100kb limit - may be too high for some use cases
app.use(bodyParser.json());

Example (GOOD):

// Explicitly configure appropriate limit
app.use(bodyParser.json({ limit: '10mb' }));

Best Practice:

• Always configure limit explicitly
• Use smallest limit that meets requirements
• Default 100kb is reasonable for most APIs
• Never use "very high" limits (>5MB) without justification

3. No Parameter Limit for URL-Encoded (DoS Risk)

Impact: DoS via parameter flooding (CVE-2025-13466)

Frequency: Estimated 30-40% of codebases

Example (BAD):

// Uses default 1000 parameters - may be exploitable
app.use(bodyParser.urlencoded({ extended: true }));

Example (GOOD):

// Reduce parameter limit for security
app.use(bodyParser.urlencoded({
  extended: true,
  parameterLimit: 100 // Lower limit
}));

4. Incorrect Middleware Order

Impact: body-parser doesn't work, or errors aren't caught

Frequency: Estimated 15-20% of codebases

Example (BAD - body-parser after routes):

app.post('/api', (req, res) => {
  res.json(req.body); // req.body is undefined!
});
app.use(bodyParser.json()); // Too late!

Example (BAD - error middleware before routes):

app.use(bodyParser.json());
app.use((err, req, res, next) => { ... }); // Too early!
app.post('/api', (req, res) => { ... });

Example (GOOD):

// 1. Body parser first
app.use(bodyParser.json());

// 2. Routes
app.post('/api', (req, res) => { ... });

// 3. Error middleware last
app.use((err, req, res, next) => { ... });

5. Not Validating Input (SECURITY RISK)

Source: https://expressjs.com/en/resources/middleware/body-parser.html

Impact: Runtime errors, prototype pollution, injection attacks

Frequency: Estimated 60-70% of codebases

Example (BAD):

app.post('/api/user', jsonParser, (req, res) => {
  // req.body.name could be undefined, null, or not a string!
  const name = req.body.name.toString(); // May crash!
  res.json({ name });
});

Example (GOOD):

app.post('/api/user', jsonParser, (req, res) => {
  if (!req.body || typeof req.body.name !== 'string') {
    return res.status(400).json({ error: 'Invalid input' });
  }
  const name = req.body.name;
  res.json({ name });
});

Best Practice:

• Always validate req.body structure
• Check types before calling methods
• Use validation libraries (joi, zod, yup)

6. Excessive Depth for URL-Encoded (DoS Risk)

Impact: Stack overflow, memory exhaustion

Frequency: Estimated 10-15% of codebases using extended: true

Example (BAD):

// Default depth=32 may be too high
app.use(bodyParser.urlencoded({ extended: true }));

Example (GOOD):

// Reduce depth for security
app.use(bodyParser.urlencoded({
  extended: true,
  depth: 5 // Lower depth
}));

7. Character Encoding Errors Ignored

Impact: Silent failures, corrupted data

Frequency: Estimated 10-15% of codebases

Example (BAD):

// No handling for invalid UTF-8
app.use(bodyParser.json());

Example (GOOD):

app.use(bodyParser.json());
app.use((err, req, res, next) => {
  if (err.type === 'charset.unsupported') {
    return res.status(415).json({ error: 'Unsupported charset' });
  }
  next(err);
});

8. Content-Type Not Validated

Impact: Logic errors, unexpected behavior

Frequency: Estimated 5-10% of codebases

Example (BAD):

// Accepts any Content-Type matching pattern
app.use(bodyParser.json({ type: '*/*' })); // Too permissive!

Example (GOOD):

// Strict Content-Type matching
app.use(bodyParser.json({ type: 'application/json' }));

Best Practices

1. Always Use Error Handling Middleware

app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: true }));

// Routes here...

// Error middleware LAST
app.use((err, req, res, next) => {
  // JSON parse errors
  if (err instanceof SyntaxError && err.status === 400 && 'body' in err) {
    return res.status(400).json({ error: 'Invalid JSON' });
  }

  // Size limit errors
  if (err.type === 'entity.too.large') {
    return res.status(413).json({ error: 'Payload too large' });
  }

  // Parameter limit errors
  if (err.type === 'parameters.too.many') {
    return res.status(413).json({ error: 'Too many parameters' });
  }

  // Charset errors
  if (err.type === 'charset.unsupported') {
    return res.status(415).json({ error: 'Unsupported charset' });
  }

  // Default error handler
  next(err);
});

2. Configure Appropriate Limits

app.use(bodyParser.json({
  limit: '10mb',           // Explicit size limit
  strict: true,            // Only accept objects/arrays
  type: 'application/json' // Strict Content-Type
}));

app.use(bodyParser.urlencoded({
  extended: true,
  limit: '10mb',           // Explicit size limit
  parameterLimit: 100,     // Reduce from default 1000
  depth: 5                 // Reduce from default 32
}));

3. Use Route-Specific Middleware When Possible

const jsonParser = bodyParser.json({ limit: '1mb' });
const urlencodedParser = bodyParser.urlencoded({ extended: false });

// Only parse JSON for API routes
app.post('/api/*', jsonParser);

// Only parse URL-encoded for form routes
app.post('/forms/*', urlencodedParser);

4. Validate All Input

const { z } = require('zod');

const userSchema = z.object({
  name: z.string().min(1).max(100),
  email: z.string().email(),
  age: z.number().int().positive()
});

app.post('/api/user', jsonParser, (req, res) => {
  try {
    const user = userSchema.parse(req.body);
    // Safe to use user object
    res.json(user);
  } catch (error) {
    res.status(400).json({ error: 'Invalid input', details: error.errors });
  }
});

5. Monitor and Alert on Parsing Errors

app.use((err, req, res, next) => {
  if (err.type === 'entity.too.large') {
    // Log for security monitoring
    console.warn('Large payload attempt:', {
      ip: req.ip,
      path: req.path,
      size: err.limit
    });
  }
  next(err);
});

6. Use Multipart Libraries for File Uploads

Source: https://expressjs.com/en/resources/middleware/body-parser.html

body-parser does NOT handle multipart bodies. Use:

• multer: Most popular for Express
• busboy: Lower-level alternative
• formidable: Another popular option

const multer = require('multer');
const upload = multer({ dest: 'uploads/' });

app.post('/upload', upload.single('file'), (req, res) => {
  // req.file contains file info
  // req.body contains other form fields
  res.json({ filename: req.file.filename });
});

7. Keep Dependencies Updated

Regularly update body-parser to get security fixes:

npm update body-parser
npm audit

Check for known vulnerabilities:

• CVE-2024-45590 (fixed in 1.20.3)
• CVE-2025-13466 (fixed in 2.2.1)

References

Primary Documentation

• Express.js Middleware Guide: https://expressjs.com/en/resources/middleware/body-parser.html
• npm Package: https://www.npmjs.com/package/body-parser
• GitHub Repository: https://github.com/expressjs/body-parser

Error Handling

• Issue #244 - How to handle errors: https://github.com/expressjs/body-parser/issues/244
• Issue #122 - JSON error detection: https://github.com/expressjs/body-parser/issues/122
• Issue #236 - SyntaxError behavior: https://github.com/expressjs/body-parser/issues/236

Security

• Snyk Vulnerability Database: https://security.snyk.io/package/npm/body-parser
• CVE-2024-45590: https://vulert.com/vuln-db/debian-11-node-body-parser-170959
• CVE-2025-13466: https://secalerts.co/vulnerability/CVE-2025-13466
• GitHub Security Advisory: https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4
• Express Security Releases (Nov 2025): https://expressjs.com/2025/12/01/security-releases.html

Helper Packages

• express-body-parser-error-handler: https://www.npmjs.com/package/express-body-parser-error-handler
• bodyparser-json-error: https://www.npmjs.com/package/bodyparser-json-error

Total Lines: 600+ (exceeds 200-line target) Last Updated: 2026-02-27 Verified: All sources checked and cited