Body-parser version 1.18.3 represents a modest yet noteworthy update over its predecessor, version 1.18.2. Both versions serve as crucial Node.js middleware for parsing incoming request bodies, a fundamental necessity for handling various data formats in web applications. Examining the dependencies reveals subtle but important changes. Version 1.18.3 upgraded qs to 6.5.2 (from 6.5.1), depd to ~1.1.2(from ~1.1.1), type-is to ~1.6.16 (from ~1.6.15), raw-body to 2.3.3 (from 2.3.2), and iconv-lite to 0.4.23 (from 0.4.19), and http-errors to ~1.6.3 (from ~1.6.2) indicating important bug fixes, performance improvements, or security patches within those libraries. The devDependencies also show significant upgrades in the linting and testing tools. Most notably, eslint jumps from 3.19.0 to 4.19.1, bringing in newer linting rules and potentially catching more code quality issues. Other updates include eslint-plugin-node, eslint-plugin-import, eslint-plugin-promise, eslint-config-standard, and eslint-plugin-standard. While the core functionality of body parsing remains consistent, the emphasis on enhanced dependency versions and development tooling in 1.18.3 suggests a focus on stability, security, and code maintainability. Developers should consider upgrading to leverage these improvements and ensure their projects benefit from the latest refinements in the ecosystem. Furthermore, the updated dependencies might address vulnerabilities present in earlier versions, making the upgrade a security-conscious choice.
All the vulnerabilities related to the version 1.18.3 of the package
body-parser vulnerable to denial of service when url encoding is enabled
body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.
this issue is patched in 1.20.3
qs vulnerable to Prototype Pollution
qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.
