@@ -0,0 +1,87 @@
+---
+title: October 2026 Security Releases
+description: Security releases for body-parser and multer have been published. We recommend that all users upgrade as soon as possible.
+tags: ['security']
+authors:
+  - name: Ulises Gascon
+    github: UlisesGascon
+---
+
+import Alert from '@components/primitives/Alert/Alert.astro';
+
+The Express team has released [body-parser](https://www.npmjs.com/package/body-parser) 2.4.0 and 1.20.9, and [multer](https://www.npmjs.com/package/multer) 2.5.0, addressing two denial-of-service vulnerabilities in request body parsing and multipart upload handling. We also want to address an upstream Brotli decoder vulnerability that affects applications accepting Brotli-compressed request bodies.
+
+<Alert type="warning">
+
+We recommend upgrading to the latest versions of body-parser and multer to secure your applications. If you have a `package-lock.json`, you can update the dependencies by running:
+
+```sh
+npm update body-parser multer
+```
+
+</Alert>
+
+The following vulnerabilities have been addressed:
+
+- [CVE-2026-111181 in body-parser middleware (High)](#cve-2026-111181-in-body-parser-middleware-high)
+- [CVE-2026-113872 in multer middleware (High)](#cve-2026-113872-in-multer-middleware-high)
+
+## CVE-2026-111181 in body-parser middleware (High)
+
+**[body-parser](https://www.npmjs.com/package/body-parser) versions `>= 2.0.0, < 2.4.0` and `< 1.20.9` are vulnerable to denial of service through trailing bytes after a compressed request body**
+
+body-parser decompresses request bodies by default. A request body made of a valid gzip member followed by trailing bytes decodes successfully and the application responds normally, but the trailing bytes then reach the already-finished decompression stream, which emits an error. Because no error listener remains except the one Node's `pipe()` adds, the error becomes an uncaught exception and crashes the process. A single unauthenticated request is enough, and no matching route or authentication is required because parsing runs before routing. The fix in 2.4.0 and 1.20.9 handles the stream error instead of letting it propagate.
+
+**Affected versions**: `>= 2.0.0, < 2.4.0` and `< 1.20.9`\
+**Patched version**: `>= 2.4.0` and `>= 1.20.9`
+
+<Alert type="info" title="Deep dive">
+
+We also published a detailed walkthrough of this vulnerability: [CVE-2026-111181: Denial of service in body-parser](/blog/2026-10-28-cve-2026-111181). If you would like more deep-dive posts like this, let us know.
+
+</Alert>
+
+For more details, see [GHSA-27r3-jxmh-p828](https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828).
+
+---
+
+## CVE-2026-113872 in multer middleware (High)
+
+**[multer](https://www.npmjs.com/package/multer) versions `>= 2.0.0, < 2.5.0` are vulnerable to denial of service through a pending asynchronous fileFilter after request teardown**
+
+multer runs a user-supplied `fileFilter` for each uploaded file. When `fileFilter` is asynchronous and a request is aborted, for example when one file is rejected, while another file's filter is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled exception that exits the process. A single unauthenticated request is enough, and any application using an asynchronous `fileFilter` is affected regardless of storage engine. Uploads using a synchronous `fileFilter` are not affected. The fix in 2.5.0 stops a pending asynchronous `fileFilter` from acting on a stream after the request has been torn down.
+
+**Affected versions**: `>= 2.0.0, < 2.5.0`\
+**Patched version**: `>= 2.5.0`
+
+For more details, see [GHSA-q7qp-rjg7-q26m](https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m).
+
+---
+
+## A note on Brotli decompression (CVE-2026-111497)
+
+Google recently published [CVE-2026-111497](https://www.cve.org/CVERecord?id=CVE-2026-111497), an out-of-bounds write in the Brotli decoder, which raised community concern about its impact on the Express ecosystem. Node.js bundles this decoder, and Express applications that accept Brotli-compressed request bodies reach it: with default options, `express.json()`, `express.urlencoded()`, and the other body parsers decompress a `Content-Encoding: br` request body through Node's `zlib.createBrotliDecompress()`.
+
+As the Express project, our recommendation is to **upgrade Node.js** to a release that ships the patched Brotli decoder. That is the real fix. Only if you cannot upgrade Node for some reason, and your application does not need Brotli-compressed request bodies, use a workaround like the following to reject them at the edge before any body parser runs:
+
+```js
+// Register before every body parser or decompression middleware.
+app.use((req, res, next) => {
+  const encoding = (req.get('Content-Encoding') || 'identity').trim().toLowerCase();
+
+  if (!['identity', 'gzip', 'deflate'].includes(encoding)) {
+    return res.status(415).send('Use gzip, deflate, or an uncompressed request body.');
+  }
+  next();
+});
+
+// Keep your existing parser options and register routes afterward.
+app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
+```
+
+Thanks to [Patch the Planet](https://patchtheplanet.org/brotli) for reporting the impact on the Express ecosystem and for the write-up and workaround.
+
+---
+
+We recommend upgrading to the latest versions of body-parser and multer, and keeping your Node.js runtime up to date, to secure your applications.