High severity - Asymmetric Resource Consumption (Amplification) vulnerability in body-parser (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: body-parser
• Introduced through: [email protected] and [email protected]

Detailed paths

• Introduced through: [email protected] › [email protected]
• Introduced through: [email protected] › [email protected] › [email protected]

Overview

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) via the extendedparser and urlencoded functions when the URL encoding process is enabled. An attacker can flood the server with a large number of specially crafted requests.

Remediation

Upgrade body-parser to version 1.20.3 or higher.

References

• GitHub Commit
  
  SNYK-JS-BODYPARSER-7926860
  (CVE-2024-45590) [email protected]