Express middleware for Node.js that parses incoming HTTP request bodies before your handlers, populating `req.body` when the request `Content-Type` matches configured options. Useful for handling JSON, raw (Buffer), text, and URL-encoded form bodies, while not handling multipart bodies.
Project status
- Actively maintained, with a recent GitHub push on 2026-06-03 and multiple version updates after that (e.g., 1.20.5 on 2026-04-24).
- Apparent update cadence: patch-level updates appear every 1 to 4 months in the recent window (1.20.4 in 2025-12-01, 1.20.5 in 2026-04-24), with an additional update in between at 2026-01-07 (v2.2.2).
AI summary generated Today
Recent updates
1.20.5
1 month agobody-parser v1.20.5 primarily fixes an extended urlencoded parsing issue where large array inputs (over 100 elements) could produce objects instead of arrays, due to qs behavior. It also includes a small refactor to JSON strict-mode error string construction and corrects an off-by-one bug in urlencoded parameter counting.
v2.2.2
5 months agoThe v2.2.2 release notes are mostly documentation changes plus a small internal refactor for JSON strict-mode error formatting, along with a qs dependency bump. The actual code diff from the provided comparison shows much larger behavioral changes consistent with a major version jump, including a removal of the generic bodyParser() middleware and significant refactors to how request bodies are read, charset validated, and decompressed.
1.20.4
6 months agobody-parser 1.20.4 updates CI tooling (Node.js version matrix, CodeQL, coverage upload) and adjusts dependency version constraints (notably qs) along with other minor dependency updates. It also includes a small logic change related to how the urlencoded parser handles the `depth` option.
Featuresv2.2.1
6 months agov2.2.1 is primarily a security release with a large CI and dependency maintenance sweep. The core change in the library code is a refactor that centralizes common body parsing validation and charset handling into lib/read.js, then simplifies the individual json, raw, text, and urlencoded middleware implementations.
SecurityFeaturesv2.2.0
3/27/2025v2.2.0 primarily refactors body-parser internals by centralizing shared option handling (charset detection, inflate/limit/verify parsing, and type-based parsing decisions) across the json, raw, text, and urlencoded parsers. The release also updates CI and test configuration, upgrades iconv-lite, and includes a small performance-oriented refactor of urlencoded parameter counting.
v2.1.0
2/10/2025v2.1.0 is primarily a dependency and internal refactor release for body-parser, modernizing how built-in node modules are imported and cleaning up removed dependencies. It also refactors decompression stream handling and updates CI workflows (including adding CodeQL).
2.0.2
10/31/2024body-parser 2.0.2 makes maintenance fixes focused on stream handling and brotli support behavior. It updates the minimum supported Node.js version, removes the external unpipe dependency, and changes brotli handling logic for Content-Encoding: br.
Breaking2.0.1
9/10/2024Release 2.0.1 fixes urlencoded parsing defaulting behavior so that bracketed keys are not parsed using the extended parser unless `extended` is enabled. The change restores expected behavior when `extended` is `false` (or omitted), and adjusts related tests and changelog history.
Breaking2.0.0
9/10/2024body-parser 2.0.0 modernizes the project for Node.js 18+ and adds brotli (br) content-encoding support across parsers that read request bodies. It also refactors urlencoded parsing to use qs with improved charset and entity handling, and updates several core dependencies.
BreakingFeatures1.20.3
9/9/2024body-parser 1.20.3 upgrades its `qs` dependency and introduces a new `depth` option to control how deeply nested keys are parsed for `application/x-www-form-urlencoded` when `extended` is true. The documented default parsing depth changes from `Infinity` to `32`.
BreakingFeatures