Body-parser 1.19.0 represents a modest upgrade over its predecessor, version 1.18.3, offering developers refinements and dependency updates. Primarily, the changes revolve around dependency enhancements rather than groundbreaking feature additions. Notably, several key dependencies have been bumped to newer releases. For instance, qs updates from 6.5.2 to 6.7.0, potentially introducing subtle query string parsing behavior adjustments or bug fixes worth considering. bytes sees an upgrade from 3.0.0 to 3.1.0 indicating possible improvements in handling byte sizes. type-is migrates from 1.6.16 to ~1.6.17, and raw-body jumps from 2.3.3 to 2.4.0 signifying enhancements in content type detection and raw body data retrieval, key aspects for parsing request bodies effectively. Furthermore, iconv-lite, used for character encoding, has been updated from 0.4.23 to 0.4.24 and http-errors from ~1.6.3 to 1.7.2, possibly addressing encoding issues or improving HTTP error handling.
The developer tooling dependencies showcases more significant change which includes upgrades to linters. These include shifts in eslint, and its associated plugins indicating improvements in code quality analysis and adherence to modern JavaScript standards. The upgrade to supertest also implies more robust testing capabilities and perhaps greater testing support for various HTTP scenarios. While the unpacked size increases slightly, indicating perhaps minor additions or refinements, the core functionality remains consistent with a focus on providing reliable body parsing middleware for Node.js applications.
All the vulnerabilities related to the version 1.19.0 of the package
body-parser vulnerable to denial of service when url encoding is enabled
body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.
this issue is patched in 1.20.3
qs vulnerable to Prototype Pollution
qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.
