--- title: October 2026 Security Releases | daily.dev description: Express has shipped security patches for body-parser and multer to fix two high-severity denial-of-service bugs. body-parser 2.4.0 and 1.20.9 fix... canonical: https://daily.dev/posts/october-2026-security-releases-rddsjgyaq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: October 2026 Security Releases | daily.dev og:description: Express has shipped security patches for body-parser and multer to fix two high-severity denial-of-service bugs. body-parser 2.4.0 and 1.20.9 fix... og:url: https://daily.dev/posts/october-2026-security-releases-rddsjgyaq og:image: https://api.daily.dev/og/posts/rDDSjGYaQ.png og:image:alt: October 2026 Security Releases og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # October 2026 Security Releases **[Express.js](https://daily.dev/sources/expressjs-blog)** · 3 min read · 0 upvotes · 0 comments ## Summary Express has shipped security patches for body-parser and multer to fix two high-severity denial-of-service bugs. body-parser 2.4.0 and 1.20.9 fix CVE-2026-111181, where trailing bytes after a compressed request body crash the process with a single unauthenticated request, since parsing runs before routing. multer 2.5.0 fixes CVE-2026-113872, where an asynchronous fileFilter can act on a torn-down stream after a request is aborted, also crashing the process. Express also flags an upstream Brotli decoder flaw, CVE-2026-111497, affecting apps that accept Brotli-compressed bodies, and recommends upgrading Node.js as the real fix rather than patching around it. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does CVE-2026-111181 in body-parser do and how do I fix it? It is a denial-of-service vulnerability in body-parser versions >= 2.0.0 and < 2.4.0, and versions < 1.20.9. A request body with a valid gzip member followed by trailing bytes triggers a stream error with no error listener attached, causing an uncaught exception that crashes the process. A single unauthenticated request triggers it since parsing runs before routing. Upgrade to body-parser 2.4.0 or 1.20.9 to fix it. _Teams patching body-parser crash bugs can track new Express security releases on daily.dev._ ### Why does multer crash when fileFilter is asynchronous and a request is aborted? In multer versions >= 2.0.0 and < 2.5.0, if a request is aborted while an asynchronous fileFilter is still pending for another file, the callback later resumes a parsing stream multer already tore down. busboy then emits an error on a stream with no error listener, which Node raises as an unhandled exception that exits the process. Synchronous fileFilter functions are not affected. Upgrade to multer 2.5.0 to fix it. _Developers debugging multer upload crashes can follow fixes like this on daily.dev._ ### Does the Brotli decoder vulnerability CVE-2026-111497 affect Express applications? Yes, Express applications that accept Brotli-compressed request bodies reach the vulnerable decoder, since express.json(), express.urlencoded(), and other body parsers decompress Content-Encoding: br bodies through Node's zlib.createBrotliDecompress() by default. The recommended fix is upgrading Node.js to a release with the patched Brotli decoder, rather than working around it, unless Node cannot be upgraded. _Developers assessing Node.js runtime risk can watch for patched releases like this on daily.dev._ ## Similar posts on daily.dev - [July 2026 Security Releases · Express.js](https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu) · Express.js · 1 upvotes · 1 comments - [September 2026 Security Releases · Express.js](https://daily.dev/posts/september-2026-security-releases-express-js-ivoho9puc) · Express.js · 1 upvotes · 0 comments - [CVE-2026-111181: Denial of service in body-parser](https://daily.dev/posts/cve-2026-111181-denial-of-service-in-body-parser-narogjw7n) · Express.js · 0 upvotes · 0 comments - [August 2026 Security Releases · Express.js](https://daily.dev/posts/august-2026-security-releases-express-js-kdzxqxlti) · Express.js · 2 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#nodejs](https://daily.dev/tags/nodejs), [#express](https://daily.dev/tags/express) [View this post on daily.dev](https://daily.dev/posts/october-2026-security-releases-rddsjgyaq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"October 2026 Security Releases","url":"https://daily.dev/posts/october-2026-security-releases-rddsjgyaq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/october-2026-security-releases-rddsjgyaq"},"datePublished":"2026-10-31T11:09:41.955Z","dateModified":"2026-10-31T11:10:09.610Z","description":"Express has shipped security patches for body-parser and multer to fix two high-severity denial-of-service bugs. body-parser 2.4.0 and 1.20.9 fix...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/552d0eb8768d96d11a652e8845b42e06?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/552d0eb8768d96d11a652e8845b42e06?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Express.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Express.js","logo":"https://media.daily.dev/image/upload/s--NvBVN7aT--/f_auto,q_auto/v1787487436/logos/expressjs-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/expressjs-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/october-2026-security-releases-rddsjgyaq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,nodejs,express","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Express.js","item":"https://daily.dev/sources/expressjs-blog"},{"@type":"ListItem","position":3,"name":"October 2026 Security Releases"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/october-2026-security-releases-rddsjgyaq#faq","mainEntity":[{"@type":"Question","name":"What does CVE-2026-111181 in body-parser do and how do I fix it?","acceptedAnswer":{"@type":"Answer","text":"It is a denial-of-service vulnerability in body-parser versions \u003e= 2.0.0 and \u003c 2.4.0, and versions \u003c 1.20.9. A request body with a valid gzip member followed by trailing bytes triggers a stream error with no error listener attached, causing an uncaught exception that crashes the process. A single unauthenticated request triggers it since parsing runs before routing. Upgrade to body-parser 2.4.0 or 1.20.9 to fix it. Teams patching body-parser crash bugs can track new Express security releases on daily.dev."}},{"@type":"Question","name":"Why does multer crash when fileFilter is asynchronous and a request is aborted?","acceptedAnswer":{"@type":"Answer","text":"In multer versions \u003e= 2.0.0 and \u003c 2.5.0, if a request is aborted while an asynchronous fileFilter is still pending for another file, the callback later resumes a parsing stream multer already tore down. busboy then emits an error on a stream with no error listener, which Node raises as an unhandled exception that exits the process. Synchronous fileFilter functions are not affected. Upgrade to multer 2.5.0 to fix it. Developers debugging multer upload crashes can follow fixes like this on daily.dev."}},{"@type":"Question","name":"Does the Brotli decoder vulnerability CVE-2026-111497 affect Express applications?","acceptedAnswer":{"@type":"Answer","text":"Yes, Express applications that accept Brotli-compressed request bodies reach the vulnerable decoder, since express.json(), express.urlencoded(), and other body parsers decompress Content-Encoding: br bodies through Node's zlib.createBrotliDecompress() by default. The recommended fix is upgrading Node.js to a release with the patched Brotli decoder, rather than working around it, unless Node cannot be upgraded. Developers assessing Node.js runtime risk can watch for patched releases like this on daily.dev."}}]} ```