--- title: July 2026 Security Releases · Express.js | daily.dev description: A security release fixes a denial of service vulnerability (CVE-2026-12590) in body-parser, the Express.js middleware. Invalid limit option values, such as... canonical: https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: July 2026 Security Releases · Express.js | daily.dev og:description: A security release fixes a denial of service vulnerability (CVE-2026-12590) in body-parser, the Express.js middleware. Invalid limit option values, such as... og:url: https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu og:image: https://api.daily.dev/og/posts/TCsj3RcGU.png og:image:alt: July 2026 Security Releases · Express.js og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # July 2026 Security Releases · Express.js **[Express.js](https://daily.dev/sources/expressjs-blog)** · 2 min read · 1 upvotes · 1 comments ## Summary A security release fixes a denial of service vulnerability (CVE-2026-12590) in body-parser, the Express.js middleware. Invalid limit option values, such as unparsable strings or NaN, silently disabled request body size enforcement, letting attackers send oversized payloads and exhaust memory and CPU. Versions below 1.20.6 and between 2.0.0 and 2.3.0 are affected. Patched versions 1.20.6 and 2.3.0 now throw an error at parser construction time when an invalid limit is passed. Users are urged to upgrade immediately. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-12590 in body-parser and how does it cause a denial of service? CVE-2026-12590 affects body-parser versions below 1.20.6 and from 2.0.0 up to but excluding 2.3.0. When configured with an invalid limit value, such as an unparsable string or NaN, the internal bytes.parse() call returned null, silently skipping the request body size check. This let attackers send arbitrarily large payloads, causing excessive memory and CPU usage. _daily.dev helps backend teams catch middleware CVEs like this before they hit production traffic._ ### How do I fix the body-parser denial of service vulnerability with invalid limit values? Upgrade body-parser to version 1.20.6 or later, or 2.3.0 or later. After the fix, invalid limit values (like an unparsable string or NaN) throw a clear error at parser construction time instead of silently disabling size enforcement, so misconfigurations are caught immediately rather than exposing the app to oversized payloads. _Teams tracking Express dependency patches use daily.dev to stay ahead of upgrade deadlines._ ### Which body-parser versions are vulnerable to the invalid limit denial of service bug and which are patched? Versions below 1.20.6 and from 2.0.0 up to but excluding 2.3.0 are vulnerable. Patched versions are 1.20.6 and above, or 2.3.0 and above. The issue is documented as GHSA-v422-hmwv-36x6 and stems from bytes.parse() returning null for invalid limit input, silently bypassing size enforcement. _Pin down exact vulnerable version ranges for dependency audits with daily.dev's developer news coverage._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > silent NaN swallowing on a security-relevant config value is a nasty bug class, this exact failure mode has bitten multer and a couple other body-size limiters over the years. worth grepping your own configs for anywhere parseInt or bytes.parse return could hit an unguarded comparison. ## Similar posts on daily.dev - [August 2026 Security Releases · Express.js](https://daily.dev/posts/august-2026-security-releases-express-js-kdzxqxlti) · Express.js · 2 upvotes · 0 comments - [Node.js — Node.js 26.5.1 \(Current\)](https://daily.dev/posts/node-js-node-js-26-5-1-current--hx951gecs) · Node.js · 25 upvotes · 0 comments - [Next.js May 2026 security release](https://daily.dev/posts/next-js-may-2026-security-release-hmqrmcava) · Vercel · 130 upvotes · 4 comments - [CERT/CC Warns binary-parser Bug Allows Node.js Privilege-Level Code Execution](https://daily.dev/posts/cert-cc-warns-binary-parser-bug-allows-node-js-privilege-level-code-execution-otz1zm7zx) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#nodejs](https://daily.dev/tags/nodejs) [View this post on daily.dev](https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"July 2026 Security Releases · Express.js","url":"https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu"},"datePublished":"2026-08-23T12:17:36.922Z","dateModified":"2026-09-14T06:44:19.674Z","description":"A security release fixes a denial of service vulnerability (CVE-2026-12590) in body-parser, the Express.js middleware. Invalid limit option values, such as...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6288da494ca45f9e0a6d453b0db1e87c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6288da494ca45f9e0a6d453b0db1e87c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Express.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Express.js","logo":"https://media.daily.dev/image/upload/s--NvBVN7aT--/f_auto,q_auto/v1787487436/logos/expressjs-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/expressjs-blog"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,cyber,nodejs","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Express.js","item":"https://daily.dev/sources/expressjs-blog"},{"@type":"ListItem","position":3,"name":"July 2026 Security Releases · Express.js"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu","comment":[{"@type":"Comment","text":"silent NaN swallowing on a security-relevant config value is a nasty bug class, this exact failure mode has bitten multer and a couple other body-size limiters over the years. worth grepping your own configs for anywhere parseInt or bytes.parse return could hit an unguarded comparison.","datePublished":"2026-08-25T18:14:40.955Z","url":"https://daily.dev/posts/TCsj3RcGU#c-QTH00WrJN","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-12590 in body-parser and how does it cause a denial of service?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-12590 affects body-parser versions below 1.20.6 and from 2.0.0 up to but excluding 2.3.0. When configured with an invalid limit value, such as an unparsable string or NaN, the internal bytes.parse() call returned null, silently skipping the request body size check. This let attackers send arbitrarily large payloads, causing excessive memory and CPU usage. daily.dev helps backend teams catch middleware CVEs like this before they hit production traffic."}},{"@type":"Question","name":"How do I fix the body-parser denial of service vulnerability with invalid limit values?","acceptedAnswer":{"@type":"Answer","text":"Upgrade body-parser to version 1.20.6 or later, or 2.3.0 or later. After the fix, invalid limit values (like an unparsable string or NaN) throw a clear error at parser construction time instead of silently disabling size enforcement, so misconfigurations are caught immediately rather than exposing the app to oversized payloads. Teams tracking Express dependency patches use daily.dev to stay ahead of upgrade deadlines."}},{"@type":"Question","name":"Which body-parser versions are vulnerable to the invalid limit denial of service bug and which are patched?","acceptedAnswer":{"@type":"Answer","text":"Versions below 1.20.6 and from 2.0.0 up to but excluding 2.3.0 are vulnerable. Patched versions are 1.20.6 and above, or 2.3.0 and above. The issue is documented as GHSA-v422-hmwv-36x6 and stems from bytes.parse() returning null for invalid limit input, silently bypassing size enforcement. Pin down exact vulnerable version ranges for dependency audits with daily.dev's developer news coverage."}}]} ```