# What changed in body-parser

> 10 changes in body-parser 2 from its official release notes, upgrade guides and advisories: 4 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-22. HTML: https://unstale.sh/npm/body-parser/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## body-parser 2

### Security

- A security fix addresses CVE-2026-111181. (1.20.9, 2.4.0) — [release notes](https://github.com/expressjs/body-parser/releases/tag/v2.4.0), [release notes](https://github.com/expressjs/body-parser/releases/tag/1.20.9)
- A security fix addresses CVE-2026-12590. (2.3.0) — [release notes](https://github.com/expressjs/body-parser/releases/tag/v2.3.0)
- Improves validation of the limit option as a security fix. (1.20.6, 2.3.0) — [release notes](https://github.com/expressjs/body-parser/releases/tag/1.20.6), [security advisory](https://github.com/advisories/GHSA-V422-HMWV-36X6), [release notes](https://github.com/expressjs/body-parser/releases/tag/v2.3.0)
- body-parser is vulnerable to denial of service when url encoding is used (2.2.1) — [security advisory](https://github.com/advisories/GHSA-WQCH-XFXH-VRR4)

### New APIs and options

- Adds support for zstandard. (2.4.0) — [release notes](https://github.com/expressjs/body-parser/releases/tag/v2.4.0)

### Performance

- Avoids the first-character regex for direct JSON bodies. (2.4.0) — [release notes](https://github.com/expressjs/body-parser/releases/tag/v2.4.0)
- A conditional check is eliminated from the JSON strict mode hot path. (2.3.0) — [release notes](https://github.com/expressjs/body-parser/releases/tag/v2.3.0)
- The empty-body guard is moved to avoid creating an extra function closure. (2.3.0) — [release notes](https://github.com/expressjs/body-parser/releases/tag/v2.3.0)

### Fixes and other changes

- Reading the body no longer mutates read options. (2.4.0) — [release notes](https://github.com/expressjs/body-parser/releases/tag/v2.4.0)
- ESM compatibility is improved, making the package work better in ESM contexts. (2.3.0) — [release notes](https://github.com/expressjs/body-parser/releases/tag/v2.3.0)