Upgrading body-parser 1 to 2
Breaking1.20.9 → 2.4.0Breaking4Security3Platform3New8Changed33Fixed6Other106
SecurityHigh · CVSS 7.5Fixes a security vulnerability tracked as CVE-2026-111181 and GHSA-27r3-jxmh-p828.GHSA-27r3-jxmh-p828 · CVE-2026-111181 ↗
BreakingUpgrade verdict
4 breaking changes and 3 platform requirement changes and 3 security fixes.
In plain terms
- The old all-in-one bodyParser() helper is gone; use the individual JSON, URL-encoded, raw, and text parsers instead.
- Setting DEBUG_FD to choose a file descriptor for debug output no longer works.
- Previously the request body object always existed, even when empty. Now it is missing unless the request actually had a body that was parsed.
- The URL-encoded body parser no longer uses the extended parsing mode by default, so nested objects and arrays are not parsed unless you opt in.
Must act Top 5 of 10 that need code or config changes
Node.js requirement changed in 2.0.2: >= 0.8 → >=18.
Drops depd, destroy, unpipe.
Installs 42 packages in all (was 43).
What you must change
Breaking4
Removes the deprecated bodyParser() combination middleware.
bodyParser()Removes support for the DEBUG_FD environment variable.
DEBUG_FDreq.body is no longer always initialized to {}; it is left undefined unless a body is parsed.req.bodyThe
urlencoded parser now defaults extended to false.urlencodedextendedSecurity3
Fixes a security vulnerability tracked as CVE-2026-111181 and GHSA-27r3-jxmh-p828.
High · CVSS 7.5Fixes a security vulnerability tracked as CVE-2026-12590 and GHSA-v422-hmwv-36x6.
Low · CVSS 3.7Fixes security vulnerability CVE-2025-13466 (GHSA-wqch-xfxh-vrr4).
Moderate · CVSS 5.3Platform3
Updates package.json engines field to reflect the minimum supported Node version.
enginesRaises the minimum supported Node.js version to 18.
Drops support for Node.js versions below LTS in v2.