npm / body-parser

body-parser

What changed in body-parser 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-22.

4 security1 new APIs and options3 performance2 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

body-parser 210 changes

Security 4

A security fix addresses CVE-2026-111181.
1.20.9, 2.4.0release notes release notes
A security fix addresses CVE-2026-12590.
2.3.0release notes
Improves validation of the limit option as a security fix.
1.20.6, 2.3.0release notes security advisory release notes
body-parser is vulnerable to denial of service when url encoding is used
2.2.1security advisory

New APIs and options 1

Adds support for zstandard.
2.4.0release notes

Performance 3

Avoids the first-character regex for direct JSON bodies.
2.4.0release notes
A conditional check is eliminated from the JSON strict mode hot path.
2.3.0release notes
The empty-body guard is moved to avoid creating an extra function closure.
2.3.0release notes

Fixes and other changes 2

Reading the body no longer mutates read options.
2.4.0release notes
ESM compatibility is improved, making the package work better in ESM contexts.
2.3.0release notes