body-parser

body-parser is the canonical Node.js middleware for reading and parsing incoming HTTP request bodies before they reach your route handlers. Maintained under the Express organization, it exposes four focused parsers — JSON, URL-encoded, raw, and text — each of which inspects the request’s Content-Type, buffers the body with sensible size limits, transparently inflates gzip/brotli/deflate encodings, and populates req.body with the decoded result.

It is deliberately narrow in scope: it does not handle multipart uploads, and each parser is a small, composable factory you mount only where you need it. That focus, combined with battle-tested charset handling and robust error normalization, has made body-parser a foundational dependency across the Node.js ecosystem with over 100 million weekly downloads.

What You Get

• Four dedicated parsers — json(), urlencoded(), raw(), and text() — each importable individually or from the main module.
• Automatic decompression of gzip, brotli, and deflate request bodies before parsing.
• Configurable body-size limits, charset validation, and a verify hook for rejecting bodies before they are parsed.
• Content-Type negotiation via the type-is library, so parsers activate only for matching requests.
• Normalized, HTTP-status-carrying errors (via http-errors) that integrate cleanly with Express error handling.

Common Use Cases

• Reading JSON API payloads into req.body in an Express or Connect application.
• Handling HTML form submissions sent as application/x-www-form-urlencoded.
• Capturing raw Buffer bodies for webhook signature verification.
• Accepting plain-text payloads on specific endpoints.

Under The Hood

Architecture

The public surface is defined in index.js, which exports four parser factories (json, raw, text, urlencoded) and a deprecated generic that now throws to steer users toward the individual middleware. Each parser module in lib/types/ follows the same shape: it calls normalizeOptions() from lib/utils.js to resolve the content type, byte limit (via the bytes library), inflate flag, default charset, and a shouldParse type-checker built on type-is, then returns an Express-style (req, res, next) function that delegates the actual work to the shared lib/read.js. read.js is the engine: it short-circuits already-finished or body-less requests, uses raw-body to buffer the stream under the size limit, pipes through Node’s zlib for gzip/brotli/deflate inflation, decodes bytes with iconv-lite, and finally invokes the parser-specific parse function before assigning req.body.

Tech Stack

A CommonJS module targeting Node.js >= 18. Its runtime dependencies are all small, single-purpose Express-org libraries: bytes (limit parsing), content-type, debug, http-errors (status-carrying errors), iconv-lite (charset decoding), on-finished, qs (extended URL-encoded parsing), raw-body (stream buffering), and type-is (Content-Type matching). Development uses ESLint with the Standard config, Mocha for tests, nyc for coverage, and supertest for HTTP-level assertions.

Code Quality

The codebase is compact and heavily tested — roughly 275 it() cases spread across dedicated suites for each parser plus utils, run with --check-leaks and coverage reporting. Source files are strict-mode, thoroughly JSDoc-annotated, and show careful attention to edge cases: the JSON parser reconstructs native-looking SyntaxError messages for strict-mode violations, normalizes error objects to drop extraneous properties, and special-cases empty bodies. Options are validated eagerly with clear TypeError messages.

API Design The developer experience is deliberately minimal and consistent. Every parser is a factory taking the same core option keys (inflate, limit, type, verify, plus parser-specific extras like strict or extended), so learning one parser transfers to all four. Parsers can be imported individually (require('body-parser/json')) to keep bundles lean, and the README documents every option and every error condition exhaustively.