Skip to content
Fencer Intel
high 7.5

CVE-2024-45590 json

body-parser vulnerable to denial of service when url encoding is enabled

published 2y ago modified 2mo ago also EUVD-2024-2860 , GHSA-qwcr-r2fm-qrc7

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Patch / fix

  • npm body-parser 1.20.3
  • expressjs body-parser 1.20.3
  • node-body-parser Debian 14, Debian 13 1.20.3+~1.19.5-1

debian advisories DEBIAN-CVE-2024-45590

  • python-tensorboard Azure Linux 3.0 2.16.2-5
  • reaper CBL-Mariner 2.0 3.1.1-13

azure linux advisories AZL-49071AZL-49126

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2024-45590 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-45590 updated cvss 7.5

body-parser: Denial of Service Vulnerability in body-parser

  • Red Hat Cryostat 3 body-parser
    affected: workaround, no fix available
  • Red Hat Migration Toolkit for Applications 7 mta/mta-ui-rhel9, mta/mta-cli-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Runtimes body-parser
    affected: workaround, no fix available
  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Lightspeed lightspeed-console-plugin-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Serverless body-parser
    affected: workaround, no fix planned “Will not fix”
  • Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7
    affected: workaround, no fix available
show 26 more
  • Red Hat Ansible Automation Platform 2 aap-cloud-ui-container, ansible-automation-platform-25/lightspeed-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat build of OptaPlanner 8 body-parser Red Hat Data Grid 8 body-parser
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 thunderbird
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Fuse 7 body-parser Red Hat Integration Camel K 1 body-parser Red Hat OpenShift Container Platform 3.11 openshift3/ose-console Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-networking-console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-dashboard-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 3 rhosdt/tempo-jaeger-query-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Process Automation 7 body-parser
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: workaround, no fix available
  • Red Hat Discovery 1 for RHEL 9 discovery/discovery-ui-rhel9 1.12.0-1, discovery/discovery-server-rhel9 1.12.0-1
    fixed: vendor fix RHSA-2025:1249
  • Red Hat NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9 v1.7.0-67, network-observability/network-observability-operator-bundle 1.7.0-86, network-observability/network-observability-rhel9-operator v1.7.0-67, network-observability/network-observability-ebpf-agent-rhel9 v1.7.0-67, network-observability/network-observability-console-plugin-rhel9 v1.7.0-67, network-observability/network-observability-flowlogs-pipeline-rhel9 v1.7.0-67
    fixed: vendor fix RHSA-2024:8014
  • Red Hat Developer Hub (RHDH) 1.4 rhdh 1.4-1734106454
    fixed: vendor fix RHBA-2024:11265
  • Red Hat Developer Hub 1.3 for RHEL 9 rhdh/rhdh-hub-rhel9 1.3-124
    fixed: vendor fix RHBA-2024:9054
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 v1.8.5-7
    fixed: vendor fix RHSA-2024:10906
  • Red Hat OpenShift AI 8 rhoai/odh-rhel8-operator v2.13.1-2, rhoai/odh-dashboard-rhel8 v2.13.1-1, rhoai/odh-modelmesh-rhel8 v2.13.1-1, rhoai/odh-operator-bundle v2.13.1-2, rhoai/odh-mm-rest-proxy-rhel8 v2.13.1-1, rhoai/odh-kueue-controller-rhel8 v2.13.1-1, +24 more
    fixed: vendor fix RHBA-2024:8413
  • Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9 v4.17.0-202501301204.p0.gcffdc60.assembly.stream.el9
    fixed: vendor fix RHSA-2025:0875
  • Red Hat OpenShift Container Platform 4.18 openshift4/metallb-rhel9 v4.18.0-202502041632.p0.gdcee704.assembly.stream.el9, openshift4/ose-ptp-rhel9 v4.18.0-202501230001.p0.gcc2e8c8.assembly.stream.el9, openshift4/rdma-cni-rhel9 v4.18.0-202501230001.p0.g36ae553.assembly.stream.el9, openshift4/sriov-cni-rhel9 v4.18.0-202501230001.p0.g150a2eb.assembly.stream.el9, openshift4/ose-dpu-cni-rhel9 v4.18.0-202501230001.p0.g99f3e30.assembly.stream.el9, openshift4/ose-dpu-daemon-rhel9 v4.18.0-202501230001.p0.g99f3e30.assembly.stream.el9, +47 more
    fixed: vendor fix RHSA-2024:6121
  • Red Hat OpenShift distributed tracing 3.4 rhosdt
    fixed: vendor fix RHSA-2024:10917
  • Red Hat OpenShift GitOps 1.12 openshift-gitops-1/dex-rhel8 v1.12.6-2, openshift-gitops-1/argocd-rhel8 v1.12.6-2, openshift-gitops-1/argocd-rhel9 v1.12.6-1, openshift-gitops-1/gitops-rhel8 v1.12.6-2, openshift-gitops-1/must-gather-rhel8 v1.12.6-2, openshift-gitops-1/kam-delivery-rhel8 v1.12.6-2, +4 more
    fixed: vendor fix RHSA-2024:8677
  • Red Hat OpenShift GitOps 1.13 openshift-gitops-1/dex-rhel8 v1.13.2-4, openshift-gitops-1/argocd-rhel8 v1.13.2-4, openshift-gitops-1/argocd-rhel9 v1.13.2-5, openshift-gitops-1/gitops-rhel8 v1.13.2-4, openshift-gitops-1/must-gather-rhel8 v1.13.2-4, openshift-gitops-1/kam-delivery-rhel8 v1.13.2-4, +4 more
    fixed: vendor fix RHSA-2024:8581
  • Red Hat Trusted Profile Analyzer 1.2 rhtpa 1.2.0-1730813392, rhtpa 1.2.0-1730929100
    fixed: fixed in 1.2.0 RHSA-2024:9885
  • Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.6-2
    fixed: vendor fix RHSA-2024:9583
  • Red Hat RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.5.5-3
    fixed: vendor fix RHSA-2024:10186
  • Red Hat RHODF 4.14 for RHEL 9 odf4/odf-console-rhel9 v4.14.18-3, odf4/ocs-client-console-rhel9 v4.14.18-2, odf4/odf-multicluster-console-rhel9 v4.14.18-2
    fixed: vendor fix RHSA-2025:8551
  • Red Hat RHODF 4.15 for RHEL 9 odf4/odf-console-rhel9 v4.15.14-2, odf4/ocs-client-console-rhel9 v4.15.14-2, odf4/odf-multicluster-console-rhel9 v4.15.14-2
    fixed: vendor fix RHSA-2025:8544
  • Red Hat RHODF 4.16 for RHEL 9 odf4/mcg-core-rhel9 v4.16.3-1, odf4/odf-console-rhel9 v4.16.10-4, odf4/ocs-client-console-rhel9 v4.16.10-4, odf4/odf-multicluster-console-rhel9 v4.16.10-3
    fixed: vendor fix RHSA-2024:8113

4 more fixed, 29 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2y ago

Exploit prediction

0.82% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm body-parser
<1.20.3
1.20.3

Affected products

  • expressjs body-parser

Classification

Weakness
  • CWE-405 Asymmetric Resource Consumption (Amplification)

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of expressjs/body-parser published their own advisory on GitHub. Reviewed sources take precedence over it.