body-parser: Node.js Body Parsing Middleware

2.2.2 · active · verified Sat Apr 18

body-parser is a Node.js middleware for parsing incoming request bodies, making them available under the `req.body` property in web frameworks like Express. It supports JSON, URL-encoded forms, raw buffers, and plain text, but explicitly does not handle multipart form data. The current stable version is 2.2.2, with active development and maintenance occurring across both the v1.x and v2.x major release lines.

Common errors

```
TypeError: Cannot read properties of undefined (reading 'body')
```
cause The appropriate `body-parser` middleware was not used for the request's `Content-Type`, or the header was missing/incorrect.

fix Ensure `app.use()` calls for `bodyParser.json()`, `bodyParser.urlencoded()`, etc., are correctly placed before your routes, and verify the client sends the correct `Content-Type` header (e.g., `application/json`).
```
PayloadTooLargeError: request entity too large
```
cause The incoming request body exceeded the configured `limit` option for the active body parser.

fix Increase the `limit` option for the relevant parser. For example, to allow up to 5MB JSON: `app.use(bodyParser.json({ limit: '5mb' }))`.
```
SyntaxError: Unexpected token < in JSON at position 0
```
cause The request body sent with `Content-Type: application/json` was not valid JSON, or the content type was mismatched.

fix Verify that the client is sending well-formed JSON data. If the client is sending HTML or another format, adjust the `Content-Type` header or use the appropriate `body-parser` middleware (e.g., `bodyParser.text()`).
```
RangeError: Maximum call stack size exceeded
```
cause A URL-encoded request body contained deeply nested data that exceeded the `depth` option (defaulting to 32) of the `urlencoded` parser.

fix If deeply nested URL-encoded data is expected, increase the `depth` option: `app.use(bodyParser.urlencoded({ extended: true, depth: 64 }))`.
```
TypeError: body-parser.json is not a function
```
cause This usually indicates `body-parser` was imported or required incorrectly, or an attempt was made to call a parser method on an undefined `body-parser` object.

fix Ensure `body-parser` is correctly imported/required (e.g., `const bodyParser = require('body-parser')` or `import bodyParser from 'body-parser';`) and that parser methods are called on the `bodyParser` object, like `bodyParser.json()`.

Warnings

breaking Version 2.0.0 elevated the minimum supported Node.js version to 18.
Fix: Ensure your Node.js environment is version 18 or higher, or continue using `body-parser` v1.x if you require older Node.js support.
breaking The combined `bodyParser()` middleware was removed in v2.x. You must now explicitly use specific parsers like `bodyParser.json()` or `bodyParser.urlencoded()`.
Fix: Replace `app.use(bodyParser())` with individual middleware calls for each desired body type, e.g., `app.use(bodyParser.json())` and `app.use(bodyParser.urlencoded({ extended: true }))`.
breaking The default `depth` for URL-encoded parsing was changed from `Infinity` to `32` in v1.20.3 (and carried into v2.x), limiting nested object/array depth.
Fix: If deeply nested URL-encoded data is required, explicitly configure the `urlencoded` parser with a higher `depth` option: `bodyParser.urlencoded({ extended: true, depth: /* new_depth */ })`.
gotcha `req.body` contains user-controlled input and its properties should always be validated before use to prevent security vulnerabilities (e.g., prototype pollution) or runtime errors.
Fix: Always sanitize and validate `req.body` properties and their types, for instance, by using schema validation libraries like Joi or Zod.
gotcha `body-parser` does not handle `multipart/form-data` request bodies, which are commonly used for file uploads.
Fix: For `multipart/form-data` requests, use dedicated middleware such as `multer`, `busboy`, or `formidable`.

Install

npm install body-parser npm
yarn add body-parser yarn
pnpm add body-parser pnpm

Imports

bodyParser

const bodyParser = require('body-parser')

Quickstart

Demonstrates how to integrate `body-parser` into an Express application to parse incoming JSON and URL-encoded request bodies, making the parsed data available on `req.body`.

import express from 'express';
import bodyParser from 'body-parser';

const app = express();
const port = process.env.PORT ?? 3000;

// Middleware to parse JSON bodies
app.use(bodyParser.json());

// Middleware to parse URL-encoded bodies (e.g., from HTML forms)
// 'extended: true' allows parsing of rich objects and arrays from URL-encoded data
app.use(bodyParser.urlencoded({ extended: true }));

// Example POST endpoint to receive data
app.post('/api/data', (req, res) => {
  console.log('Received body:', req.body);
  // req.body contains the parsed data based on Content-Type
  res.json({ message: 'Data received successfully!', data: req.body });
});

// Start the server
app.listen(port, () => {
  console.log(`Server listening on port ${port}`);
});

view raw JSON →