body-parser - npm Package Compare versions

Comparing version 1.20.5 to 1.20.6

HISTORY.md

@@ -0,4 +1,10 @@
+1.20.6 / 2026-07-09
+===================
+* fix: improve `limit` option validation (#698)
+  * Invalid `limit` values (e.g. unparseable strings or `NaN`) now throw instead of being silently ignored, which previously disabled size limit enforcement
+  * `null` and `undefined` fall back to the default 100kb limit
+
 1.20.5 / 2026-04-24
 ===================
-* refactor(json): simplify strict mode error string construction 
+* refactor(json): simplify strict mode error string construction
 * fix: extended urlencoded parsing of arrays with >100 elements (#716)
@@ -5,0 +11,0 @@ * deps: qs@~6.15.1

lib/types/json.js

@@ -56,5 +56,5 @@ /*!
 
-  var limit = typeof opts.limit !== 'number'
-    ? bytes.parse(opts.limit || '100kb')
-    : opts.limit
+  var limit = typeof opts.limit === 'undefined' || opts.limit === null
+    ? 102400 // 100kb default
+    : bytes.parse(opts.limit)
   var inflate = opts.inflate !== false
@@ -66,2 +66,6 @@ var reviver = opts.reviver
 
+  if (limit === null) {
+    throw new TypeError('option limit "' + String(opts.limit) + '" is invalid')
+  }
+
   if (verify !== false && typeof verify !== 'function') {
@@ -68,0 +72,0 @@ throw new TypeError('option verify must be function')

lib/types/raw.js

@@ -36,8 +36,12 @@ /*!
   var inflate = opts.inflate !== false
-  var limit = typeof opts.limit !== 'number'
-    ? bytes.parse(opts.limit || '100kb')
-    : opts.limit
+  var limit = typeof opts.limit === 'undefined' || opts.limit === null
+    ? 102400 // 100kb default
+    : bytes.parse(opts.limit)
   var type = opts.type || 'application/octet-stream'
   var verify = opts.verify || false
 
+  if (limit === null) {
+    throw new TypeError('option limit "' + String(opts.limit) + '" is invalid')
+  }
+
   if (verify !== false && typeof verify !== 'function') {
@@ -44,0 +48,0 @@ throw new TypeError('option verify must be function')

lib/types/text.js

@@ -38,8 +38,12 @@ /*!
   var inflate = opts.inflate !== false
-  var limit = typeof opts.limit !== 'number'
-    ? bytes.parse(opts.limit || '100kb')
-    : opts.limit
+  var limit = typeof opts.limit === 'undefined' || opts.limit === null
+    ? 102400 // 100kb default
+    : bytes.parse(opts.limit)
   var type = opts.type || 'text/plain'
   var verify = opts.verify || false
 
+  if (limit === null) {
+    throw new TypeError('option limit "' + String(opts.limit) + '" is invalid')
+  }
+
   if (verify !== false && typeof verify !== 'function') {
@@ -46,0 +50,0 @@ throw new TypeError('option verify must be function')

lib/types/urlencoded.js

@@ -53,8 +53,12 @@ /*!
   var inflate = opts.inflate !== false
-  var limit = typeof opts.limit !== 'number'
-    ? bytes.parse(opts.limit || '100kb')
-    : opts.limit
+  var limit = typeof opts.limit === 'undefined' || opts.limit === null
+    ? 102400 // 100kb default
+    : bytes.parse(opts.limit)
   var type = opts.type || 'application/x-www-form-urlencoded'
   var verify = opts.verify || false
 
+  if (limit === null) {
+    throw new TypeError('option limit "' + String(opts.limit) + '" is invalid')
+  }
+
   if (verify !== false && typeof verify !== 'function') {
@@ -61,0 +65,0 @@ throw new TypeError('option verify must be function')

package.json

 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "1.20.5",
+  "version": "1.20.6",
   "contributors": [
@@ -6,0 +6,0 @@ "Douglas Christopher Wilson <[e-mail]>",

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Improved metrics

Total package byte prevSize

62434

1.39%

Lines of code

950

1.28%

Number of medium supply chain risk alerts

0

-100%

No dependency changes