Detections
Analytics

Echo: body-parser: security update to 1.20.6

medium Tenable Self-Hosted Container Security Plugin ID 462870

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is
 configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns
 null and the request body size check is silently skipped. Applications that rely on limit as their primary
 safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive
 memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0.
 After the fix, invalid limit values throw a clear error at parser construction time instead of silently
 disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb.
 Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at
 startup and reject any configuration where the result is null or a non-finite number. (CVE-2026-12590)

Solution

Update the body-parser library and its related packages to version 1.20.6 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-12590

Plugin Details

Severity: Medium

ID: 462870

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.74

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-12590

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 7/9/2026

Reference Information

CVE: CVE-2026-12590