Registry / http-networking / body-parser

body-parser

JSON →
library2.2.2jsnpmunverified

body-parser is a Node.js middleware for Express that parses incoming request bodies, making them available under the `req.body` property. It currently maintains two major stable versions: `v2.2.2` (for Node.js 18+) and `v1.20.4` (for older Node.js versions), with regular updates addressing security and dependency concerns.

http-networkingweb-framework
npm install body-parser
github ↗package ↗
INSTALL
IMPORT
SIG · BODY-PARSER
B
body-parser
http-networkingjavascriptv2.2.2
Install
—
Import
—
Disk
—
Pass rate
0/ 6
Env Coverage0 / 6
glibc
18–22
musl
18–22
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18–226 runs
build_error
glibc
node 18–226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

bodyParser.json
✓ const bodyParser = require('body-parser'); app.use(bodyParser.json());
✗ import { json } from 'body-parser';
body-parser exports functions directly off its main module; `require('body-parser').json` is the standard CommonJS pattern. Direct named imports for individual parsers are not supported.
bodyParser.urlencoded
✓ const bodyParser = require('body-parser'); app.use(bodyParser.urlencoded({ extended: true }));
✗ import { urlencoded } from 'body-parser';
`urlencoded` requires an `{ extended: true }` or `{ extended: false }` option to specify the parsing algorithm. Direct named imports are not supported for individual parsers.
bodyParser
✓ const bodyParser = require('body-parser');
✗ import bodyParser from 'body-parser';
The `body-parser` module is a CommonJS module that exports an object containing parser factories. It should be imported using `require()` for Node.js environments.

This Express.js application demonstrates how to integrate `body-parser` to handle both JSON and URL-encoded form data. It shows setting up the middleware globally and accessing the parsed data via `req.body` in route handlers.

const express = require('express'); const bodyParser = require('body-parser'); const app = express(); const port = 3000; // Parse JSON bodies app.use(bodyParser.json()); // Parse URL-encoded bodies app.use(bodyParser.urlencoded({ extended: true })); // `extended: true` for richer objects and arrays app.post('/submit-json', (req, res) => { console.log('Received JSON body:', req.body); // Example of validating input if (!req.body || typeof req.body.name !== 'string') { return res.status(400).send('Name is required in JSON body.'); } res.json({ message: `Hello, ${req.body.name}!` }); }); app.post('/submit-form', (req, res) => { console.log('Received URL-encoded body:', req.body); if (!req.body || typeof req.body.email !== 'string') { return res.status(400).send('Email is required in form body.'); } res.send(`Form submitted by: ${req.body.email}`); }); app.listen(port, () => { console.log(`Server listening at http://localhost:${port}`); });
Debug
Known issues
breakingbody-parser v2.x requires Node.js v18 or newer. Older Node.js versions (e.g., v16) are not supported and may lead to runtime errors.
fix
Upgrade your Node.js environment to v18 or a more recent LTS version, or remain on `body-parser` v1.x if bound to an older Node.js runtime.
affects: >=2.0.0
breakingA security vulnerability (CVE-2025-13466, GHSA-wqch-xfxh-vrr4) was identified, potentially leading to denial-of-service or other impacts related to body parsing. This was fixed in `v2.2.1` and `v1.20.4`.
fix
Upgrade `body-parser` to `v2.2.1` or `v1.20.4` (or newer) immediately to mitigate the vulnerability.
affects: <2.2.1, <1.20.4
breakingThe top-level `bodyParser()` combination middleware, which included all parsers, was deprecated in 1.x and completely removed in 2.x. You must now use individual parsers like `bodyParser.json()` and `bodyParser.urlencoded()`.
fix
Replace `app.use(bodyParser())` with specific parsers, e.g., `app.use(bodyParser.json()); app.use(bodyParser.urlencoded({ extended: true }));`
affects: >=2.0.0
breakingIn `body-parser` v1.20.3, the default `depth` level for parsing URL-encoded data changed from `Infinity` to `32`. This can lead to truncated or incomplete parsing of deeply nested objects.
fix
If your application relies on deeply nested URL-encoded data, explicitly set the `depth` option, e.g., `bodyParser.urlencoded({ extended: true, depth: Infinity })`.
affects: >=1.20.3 <2.0.0
gotchaThe `req.body` object is populated with user-controlled input and its properties should be treated as untrusted. Direct access to properties or methods without validation can lead to runtime errors or security vulnerabilities.
fix
Always validate the shape and types of properties in `req.body` before using them, e.g., `if (typeof req.body.foo !== 'string') { /* handle error */ }`.
affects: all
gotcha`body-parser` does not handle `multipart/form-data` bodies, commonly used for file uploads. Attempting to parse these with `body-parser` will result in an empty `req.body`.
fix
For `multipart/form-data`, use dedicated middleware like `multer`, `busboy`, `multiparty`, or `formidable`.
affects: all
gotcha`body-parser` only processes requests where the `Content-Type` header matches the parser's configured `type` option (e.g., `application/json` for `json()` parser). If the header is missing or mismatched, `req.body` will be an empty object or undefined.
fix
Ensure the client sends the correct `Content-Type` header for the body being sent. If `req.body` is unexpectedly empty, check the `Content-Type` header in the incoming request.
affects: all
Errors
Common errors & fixes
Cannot find module 'body-parser'
The `body-parser` package is not installed in the project's `node_modules`.
fix
Run `npm install body-parser` or `yarn add body-parser` in your project directory.
Error: request entity too large
The incoming request body exceeds the configured `limit` option for the parser (default '100kb').
fix
Increase the `limit` option for the specific parser, e.g., `app.use(bodyParser.json({ limit: '5mb' }))`.
`req.body` is undefined or empty after middleware
The `Content-Type` header of the incoming request does not match the parser type, or the middleware is not correctly applied before the route handler, or the body is empty.
fix
Verify the client's `Content-Type` header (e.g., `application/json`, `application/x-www-form-urlencoded`). Ensure `app.use(bodyParser.json())` (or other parsers) is placed before your route handlers. Also, confirm the request actually contains a body.
SyntaxError: Unexpected token 'X' in JSON at position Y
The request body for `bodyParser.json()` is not valid JSON, or the `Content-Type` is `application/json` but the body is actually URL-encoded or text.
fix
Ensure the client sends a well-formed JSON string. If the content is not JSON, use the appropriate parser (e.g., `bodyParser.urlencoded()` or `bodyParser.text()`).
TypeError: Cannot read properties of undefined (reading 'someProp')
Attempting to access a property on `req.body` (or a nested object within `req.body`) that does not exist, likely because the client did not send it or sent a different structure.
fix
Implement robust validation for `req.body` properties before accessing them, e.g., `if (req.body && typeof req.body.someProp === 'string') { /* handle missing/invalid prop */ } else { /* handle missing/invalid prop */ }`.
Upgrade
Version history
2.2.2latest on npm
Audit
Dependencies

No dependency data recorded yet.

Agent activity
21 hits · last 30 days
node
18
OpenAI (training)
1
Resources
githubhttps://github.com/expressjs/body-parser ↗
packagehttps://www.npmjs.com/package/body-parser ↗
body-parser — npm install body-parser · libregistry