The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is     configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns     null and the request body size check is silently skipped. Applications that rely on limit as their primary     safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive     memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0.
    After the fix, invalid limit values throw a clear error at parser construction time instead of silently     disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb.
    Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at     startup and reject any configuration where the result is null or a non-finite number. (CVE-2026-12590)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-12590

medium Nessus Plugin ID 326077

Version 1.2