Express: July 2026 Security Releases

The Express team has released body-parser 1.20.6 and 2.3.0, addressing CVE-2026-12590, a low-severity vulnerability where an invalid limit option value silently disabled request body size enforcement, allowing arbitrarily large payloads and potential denial of service. Invalid limit values now throw an error at parser construction time.