Express body-parser uncaught exception via trailing bytes after compressed request body

#!/usr/bin/env bash
# check_bodyparser_cve2026111181.sh
# Checks whether a Node.js project uses a body-parser version vulnerable to
# CVE-2026-111181 (DoS via trailing bytes after compressed request body).
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"

if [ ! -d "$PROJECT_DIR" ]; then
  echo "UNKNOWN — directory '$PROJECT_DIR' does not exist"
  exit 2
fi

cd "$PROJECT_DIR"

# Try npm list first (works if node_modules is installed)
if command -v npm &>/dev/null && [ -d node_modules ]; then
  BP_VERSION=$(npm list body-parser --depth=10 --json 2>/dev/null | \
    node -e "
      const j = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
      function find(deps) {
        if (!deps) return null;
        for (const [k,v] of Object.entries(deps)) {
          if (k === 'body-parser') return v.version;
          const r = find(v.dependencies);
          if (r) return r;
        }
        return null;
      }
      const v = find(j.dependencies);
      if (v) process.stdout.write(v);
      else process.exit(1);
    " 2>/dev/null) || BP_VERSION=""
else
  BP_VERSION=""
fi

# Fallback: read package.json in node_modules directly
if [ -z "$BP_VERSION" ] && [ -f node_modules/body-parser/package.json ]; then
  BP_VERSION=$(node -e "console.log(require('./node_modules/body-parser/package.json').version)" 2>/dev/null) || BP_VERSION=""
fi

if [ -z "$BP_VERSION" ]; then
  echo "UNKNOWN — body-parser not found in $PROJECT_DIR"
  exit 2
fi

echo "Found body-parser version: $BP_VERSION"

# Compare versions using node's semver-compatible comparison
RESULT=$(node -e "
  const v = '$BP_VERSION';
  const parts = v.split('.').map(Number);
  const major = parts[0], minor = parts[1], patch = parts[2] || 0;

  // Vulnerable: < 1.20.9 (1.x line) OR >= 2.0.0 and < 2.4.0 (2.x line)
  if (major === 1) {
    if (minor < 20 || (minor === 20 && patch < 9)) {
      console.log('VULNERABLE');
    } else {
      console.log('PATCHED');
    }
  } else if (major === 2) {
    if (minor < 4) {
      console.log('VULNERABLE');
    } else {
      console.log('PATCHED');
    }
  } else if (major === 0) {
    console.log('VULNERABLE');
  } else {
    console.log('PATCHED');
  }
" 2>/dev/null) || RESULT="UNKNOWN"

echo "$RESULT — body-parser $BP_VERSION vs CVE-2026-111181 (fixed in 1.20.9 / 2.4.0)"

case "$RESULT" in
  VULNERABLE) exit 1 ;;
  PATCHED)    exit 0 ;;
  *)          exit 2 ;;
esac