Body-parser 1.18.2 is a minor update to the popular Node.js body parsing middleware, building upon version 1.18.1. Both versions share the same core functionalities for parsing incoming request bodies in various formats like JSON, URL-encoded, and raw text, making them essential for handling user input in Express.js applications. Developers will find both versions offer identical functionalities related to the core parsing capabilities and integration with Express routing.
However, the key difference lies in an updated dependency: debug was upgraded to version 2.6.9 from 2.6.8. This suggests a fix or enhancement within the debugging tools, potentially impacting developers who heavily rely on debugging output during the development process.
Other dependencies remain consistent, including crucial libraries like qs for query string parsing, raw-body for efficient body data handling, and iconv-lite for character encoding conversions ensuring continued reliable operation. Likewise, the development dependencies, used for testing and linting, are unchanged further suggesting a focus on maintenance and minor improvements rather than significant feature additions.
The update ensures that developers benefit from the latest fixes and improvements in debugging utilities as offered by the debug dependency. The MIT license guarantees freedom for both commercial and non-commercial projects, simplifying integration, and the availability of the source code on GitHub encourages community contributions. The releaseDate of the newer version also signals to users that it's a recent and actively maintained piece of software.
All the vulnerabilities related to the version 1.18.2 of the package
body-parser vulnerable to denial of service when url encoding is enabled
body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.
this issue is patched in 1.20.3
qs vulnerable to Prototype Pollution
qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.
