body-parser vulnerable to denial of service when url encoding is enabled

[PavelMor25]

Repositories:

• testcafe-hammerhead - https://github.com/PavelMor25/testcafe-hammerhead/security/dependabot/21

Package: body-parser

Description:

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References

CVE ID: CVE-2024-45590

GHSA ID: GHSA-qwcr-r2fm-qrc7