Repository navigation
fix: reject compressed request bodies in every body parser - #2191
Merged
Merged
Conversation
No client sends a compressed request body, but body-parser inflates gzip, deflate and br by default, so any request reached Node's zlib/brotli decoders (CVE-2026-111497). With inflate: false, an encoded body gets a 415. The Node 24.22.1 bump is the actual fix; this removes the attack surface.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No client sends a compressed request body, but body-parser inflates
gzip,deflateandbrby default. That means anyone can push a crafted stream into Node's zlib/Brotli decoders withContent-Encoding: br(CVE-2026-111497, "Node2Shell"). Cloudflare doesn't decode request bodies before passing them to the origin, so it doesn't protect us here.This sets
inflate: falseon every parser inapi(global parsers, Stripe webhook, CSP reports),geo-ip-apiandadmin-api. A request with an encoded body now gets415 encoding.unsupported; uncompressed (identity) bodies are unaffected.The Node 24.22.1 bump (#2188) is the actual fix. This removes the attack surface in case of future decoder bugs.
Verified
typecheckpasses for api, geo-ip-api and admin-apibr-encoded body returns 415