Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is
    configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns
    null and the request body size check is silently skipped. Applications that rely on limit as their primary
    safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive
    memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0.
    After the fix, invalid limit values throw a clear error at parser construction time instead of silently
    disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb.
    Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at
    startup and reject any configuration where the result is null or a non-finite number. (CVE-2026-12590)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is     configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns     null and the request body size check is silently skipped. Applications that rely on limit as their primary     safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive     memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0.
    After the fix, invalid limit values throw a clear error at parser construction time instead of silently     disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb.
    Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at     startup and reject any configuration where the result is null or a non-finite number. (CVE-2026-12590)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
462870	Echo: body-parser: security update to 1.20.6	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462870	Echo: body-parser: security update to 1.20.6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
326077	Linux Distros Unpatched Vulnerability : CVE-2026-12590	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-12590

medium

Tenable Plugins

medium

medium

medium