The body-parser library implements request body size checks based on a configurable limit. This reflects a resource exhaustion weakness (CWE-770). In versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), setting the limit option to an invalid value—such as an unparseable string or NaN—causes bytes.parse to return null, which the parser interprets as disabling the size enforcement silently. As a result, applications that rely on the limit setting as their primary protection can accept arbitrarily large request bodies, exhausting memory and CPU and leading to denial of service.

All Node.js applications that use the body-parser library before version 1.20.6 on the 1.x branch or before 2.3.0 on the 2.x branch are affected. This includes any project that configures body-parser's limit option, especially when the value originates from external configuration sources.

The vulnerability has a CVSS score of 3.7, indicating low overall severity, and an EPSS score of < 1%, showing a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker might manipulate the configuration to provide an invalid limit value, after which the application would accept a large payload that could exhaust resources. No public exploits are documented, but the risk warrants prompt mitigation.