
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
Gets the entire buffer of a stream either as a Buffer or a string.
Validates the stream's length against an expected length and maximum limit.
Ideal for parsing request bodies.
This is a Node.js module available through the
npm registry. Installation is done using the
npm install command:
$ npm install raw-body
This module includes a TypeScript
declaration file to enable auto complete in compatible editors and type
information for TypeScript projects. This module depends on the Node.js
types, so install @types/node:
$ npm install @types/node
var getRawBody = require('raw-body')
Returns a promise if no callback specified and global Promise exists.
Options:
length - The length of the stream.
If the contents of the stream do not add up to this length,
an 400 error code is returned.limit - The byte limit of the body.
This is the number of bytes or any string format supported by
bytes,
for example 1000, '500kb' or '3mb'.
If the body ends up being larger than this limit,
a 413 error code is returned.encoding - The encoding to use to decode the body into a string.
By default, a Buffer instance will be returned when no encoding is specified.
Most likely, you want utf-8, so setting encoding to true will decode as utf-8.
You can use any type of encoding supported by iconv-lite.You can also pass a string in place of options to just specify the encoding.
If an error occurs, the stream will be paused, everything unpiped,
and you are responsible for correctly disposing the stream.
For HTTP requests, you may need to finish consuming the stream if
you want to keep the socket open for future requests. For streams
that use file descriptors, you should stream.destroy() or
stream.close() to prevent leaks.
This module creates errors depending on the error condition during reading. The error may be an error from the underlying Node.js implementation, but is otherwise an error created by this module, which has the following attributes:
limit - the limit in byteslength and expected - the expected length of the streamreceived - the received bytesencoding - the invalid encodingstatus and statusCode - the corresponding status code for the errortype - the error typeThe errors from this module have a type property which allows for the programmatic
determination of the type of error returned.
This error will occur when the encoding option is specified, but the value does
not map to an encoding supported by the iconv-lite
module.
This error will occur when the limit option is specified, but the stream has
an entity that is larger.
This error will occur when the request stream is aborted by the client before reading the body has finished.
This error will occur when the length option is specified, but the stream has
emitted more bytes.
This error will occur when the given stream has an encoding set on it, making it
a decoded stream. The stream should not have an encoding set and is expected to
emit Buffer objects.
This error will occur when the given stream is not readable.
var contentType = require('content-type')
var express = require('express')
var getRawBody = require('raw-body')
var app = express()
app.use(function (req, res, next) {
getRawBody(req, {
length: req.headers['content-length'],
limit: '1mb',
encoding: contentType.parse(req).parameters.charset
}, function (err, string) {
if (err) return next(err)
req.text = string
next()
})
})
// now access req.text
var contentType = require('content-type')
var getRawBody = require('raw-body')
var koa = require('koa')
var app = koa()
app.use(function * (next) {
this.text = yield getRawBody(this.req, {
length: this.req.headers['content-length'],
limit: '1mb',
encoding: contentType.parse(this.req).parameters.charset
})
yield next
})
// now access this.text
To use this library as a promise, simply omit the callback and a promise is
returned, provided that a global Promise is defined.
var getRawBody = require('raw-body')
var http = require('http')
var server = http.createServer(function (req, res) {
getRawBody(req)
.then(function (buf) {
res.statusCode = 200
res.end(buf.length + ' bytes submitted')
})
.catch(function (err) {
res.statusCode = 500
res.end(err.message)
})
})
server.listen(3000)
import * as getRawBody from 'raw-body';
import * as http from 'http';
const server = http.createServer((req, res) => {
getRawBody(req)
.then((buf) => {
res.statusCode = 200;
res.end(buf.length + ' bytes submitted');
})
.catch((err) => {
res.statusCode = err.statusCode;
res.end(err.message);
});
});
server.listen(3000);
body-parser is a popular Express middleware that parses incoming request bodies before your handlers, available under the req.body property. It wraps around raw-body and adds additional parsing capabilities for JSON, URL-encoded, and other formats. Unlike raw-body, which provides the raw buffer, body-parser converts the body into more usable formats.
co-body is a body parser for koa and express, built on top of raw-body, designed to work with co for generator-based flow control. It supports json, form and text types of bodies, but is more tailored for use with Koa and generators.
busboy is a streaming parser for HTML form data for node.js. It handles multipart/form-data, which is primarily used for uploading files. It differs from raw-body in that it's specialized for file uploads and form submissions, whereas raw-body is more about getting the entire raw request body.
FAQs
Get and validate the raw body of a readable stream.
The npm package raw-body receives a total of 53,742,238 weekly downloads. As such, raw-body popularity was classified as popular.
We found that raw-body demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.