CVE-2021-3666: body-parser-xml vulnerable to Prototype Pollution
Summary
CVE-2021-3666: body-parser-xml vulnerable to Prototype Pollution. Affects body-parser-xml versions < 2.0.3. Fixed in 2.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
body-parser-xml is an npm package that provides XML body parsing functionality for Node.js applications. It allows parsing XML request bodies and populating the req.body object with the parsed data. This package is commonly used in web applications that handle XML data. However, it is vulnerable to a security issue known as Prototype Pollution.
Vulnerability Detail
The vulnerability in body-parser-xml is due to an improper control of modification of object prototype attributes, also known as Prototype Pollution. This type of vulnerability occurs when an attacker can modify the prototype of an object, leading to unexpected behavior and potential security issues. In the case of body-parser-xml, an attacker can manipulate the XML data to modify the prototype of the parsed object, potentially allowing them to execute arbitrary code or perform unauthorized actions.
How To Fix
Latest published version: 2.0.5 as of 22 Oct 2026
npm install body-parser-xml@2.0.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.3
This is the first release that contains the fix.
npm install body-parser-xml@2.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to avoid using the body-parser-xml package or disable XML body parsing in your application. This can be achieved by removing the package from your project's dependencies or modifying your application's configuration to exclude XML parsing.
Conclusion
In conclusion, the body-parser-xml package is vulnerable to Prototype Pollution, which can allow attackers to execute arbitrary code or perform unauthorized actions. It is crucial to update the package to version 2.0.3 or later to mitigate this vulnerability. If immediate updating is not possible, consider using a workaround or disabling XML body parsing. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for body-parser-xml →
FAQ
body-parser-xml is an npm package that provides XML body parsing functionality for Node.js applications.
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior and potential security issues.
The potential consequences of this vulnerability include the execution of arbitrary code or unauthorized actions by an attacker.
To fix this vulnerability, update the body-parser-xml package to version 2.0.3 or later.
Yes, you can temporarily avoid using the body-parser-xml package or disable XML body parsing in your application.
