Skip to content

Conversation

UlisesGascon
Copy link
Member

This PR introduces the ability to customize the depth level in body-parser (default is 32, previously Infinity). Lower values are recommended for security reasons when possible.

You can customize it like this:

app.post('/', bodyParser.urlencoded({
    depth: 5,
    // Other options...
})

@UlisesGascon UlisesGascon merged commit 2360ae7 into expressjs:master Sep 9, 2024
49 checks passed
@UlisesGascon UlisesGascon deleted the feat/upgrade-body-parser branch September 9, 2024 23:36
UlisesGascon added a commit that referenced this pull request Sep 10, 2024
bjohansebas added a commit to expressjs/expressjs.com that referenced this pull request Aug 4, 2025
This option was also not documented. It was added as part of a fix for a
vulnerability (see
GHSA-qwcr-r2fm-qrc7).

ref: expressjs/express#5926,
expressjs/body-parser@afd0f39
---------

Signed-off-by: Sebastian Beltran <[email protected]>
Co-authored-by: UlisesGascon <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants