CVE-2024-45590: expressjs body-parser
CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2024-45590DEBIAN-CVE-2024-45590CGA-2h74-5987-33rmCGA-3886-4876-hp2jCGA-4668-w4hw-hqfxCGA-526p-vp5w-6g64CGA-5prw-68gx-cmxxCGA-66gc-5vg9-pwwjCGA-697v-cx4r-62w4CGA-6qr4-rfvp-77x3CGA-728f-cpf2-q6qxCGA-7wvc-253g-c8qmCGA-85v7-pvc9-rhwcCGA-86g3-4c6x-36rmCGA-8r2j-x2px-4g58CGA-9cww-82p2-j5r7CGA-9pqh-7fc3-pr95CGA-f52j-6fcp-7m63CGA-fg62-q339-xgqjCGA-fhfc-mmgm-8mwfCGA-ghcp-mg53-vg58CGA-jghq-4gxm-c3jmCGA-jw68-g4fq-j2mjCGA-p25h-5pwg-9fq3CGA-p629-39mc-w456CGA-p6q8-gj26-6cfqCGA-pp9q-864w-55qpCGA-qc45-hh53-5mfwCGA-qhh9-3gmv-gwcmCGA-qqrh-r2xv-vhrmCGA-wqvp-pch9-jc7mCGA-x23x-v693-vx9jCGA-x2hr-x284-8f36CGA-xw35-g8fh-3596GHSA-qwcr-r2fm-qrc7CGA-6wqg-w59v-4x2hCGA-qjr4-9c65-58hm
Published 10-09-2024Last modified 10-09-2024
Vulnerability summary
CVE-2024-45590 is a high (CVSS 7.5) vulnerability in expressjs body-parser. EPSS estimates a 0.82% chance of exploitation in the next 30 days, higher than 56.6% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.82%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 4Timeline
- 10-09-2024PublishedVulnerability first disclosed.
- 10-09-2024Last modifiedVulnerability information updated.
Description
body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.
CVSS metrics
8 scores · 7 sources · 2 versionsHigh 8.7Preferred score · OSV · Npm (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesSingle source
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.82%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
0.00 pp
From 0.82% on 19-09-2026
19-09-202619-10-2026
EPSS score0.82%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- arangodb-3.11< 3.11.14.5-r11
- argo-workflows< 3.6.5-r2
- kubeflow-centraldashboard< 1.9.0-r4
- kubeflow-pipelines< 2.2.0-r12
- kubeflow-pipelines-apiserver< 2.2.0-r12
Wolfi16 products
- argo-workflows< 3.6.5-r2
- kubeflow-centraldashboard< 1.9.0-r4
- kubeflow-pipelines< 2.2.0-r12
- kubeflow-pipelines-apiserver< 2.2.0-r12
- kubeflow-pipelines-cache_server< 2.2.0-r12
Debian1 product
- node-body-parserAll versions (No fix recorded) | < 1.20.3+~1.19.5-1
Expressjs1 product
- body-parser< 1.20.3
Npm1 product
- body-parser< 1.20.3
Openjsf1 product
- body-parser< 1.20.3
Ubuntu1 product
- node-body-parserAll versions (No fix recorded)
7 vendors · 38 products
References
8 links- github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
- github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bceX Refsource MISCFIXWEBPatch
