body-parser, a middleware used by Node.js and Express applications, contains a flaw that can cause any request containing a compressed body to terminate the entire application. The vulnerability is triggered when a request contains one valid compressed frame followed by unexpected trailing bytes. After parsing the body, the decompression stream is left without an error listener; the trailing bytes are then processed, an error is emitted, and the application throws an uncaught exception that crashes the process. This results in a loss of availability for all endpoints that parse request bodies. The weakness corresponds to CWE-248: Unexpected Resource Availability Condition.

The affected components are body-parser versions prior to 1.20.9 and the 2.0.0 series before 2.4.0. Any Express or Node.js application using body-parser with its default configuration (inflate set to true) and exposed routes that accept a request body is susceptible. Updating to body-parser 1.20.9, 2.4.0, or a later release removes the flaw.

The CVSS score of 7.5 categorises this as a high severity vulnerability, and the absence of an EPSS entry suggests no publicly reported exploitation yet. The issue is not listed in CISA's KEV catalog, but the attack vector is straightforward: an attacker can craft a single HTTP request with a gzip‑encoded body containing trailing data. Because body parsing occurs before routing, no specific endpoint must be targeted; any request that reaches the middleware will trigger the crash. Organisations should treat this as a high‑risk denial‑of‑service vector until a patch is applied.