A body parser is a piece of middleware in a web framework that reads the body of an incoming HTTP request and converts it into a form the application can use. For example, it turns a JSON payload or submitted form data into an object that route handlers can read. Without one, the application would have to read and interpret the raw bytes itself.
Because a body parser handles data from outside, it sits on a path that attackers can reach. Parsers usually apply limits on body size and accept only certain content types, and some can also decompress request bodies that arrive compressed, depending on the parser and its configuration. Which encodings are supported differs between parsers and versions, so check the documentation for the one you use.
The presence of a body parser does not by itself mean an application is exposed to a particular vulnerability. If a flaw sits in a library that the parser uses for decompression, what matters is whether the application actually accepts and decompresses untrusted input in that format. A parser that never handles the affected encoding does not exercise the flawed code.
To reduce risk, set sensible size limits, accept only the content types you expect, keep the framework and its dependencies updated and review which request encodings are enabled. When assessing a vulnerability report, check the versions of both the framework and the underlying runtime, and test whether untrusted data really reaches the affected code.