From 2ea64e6dc1252bfd56582744c0cfe88ce7b9fd98 Mon Sep 17 00:00:00 2001
From: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Date: Wed, 21 Oct 2026 17:26:57 +0200
Subject: [PATCH] 1.20.9

---
 HISTORY.md   | 9 +++++++--
 package.json | 2 +-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index a14229ac..bed56429 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,10 +1,15 @@
+1.20.9
+======
+
+* Security fix for [GHSA-27r3-jxmh-p828](https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828) (CVE-2026-111181)
+
 1.20.8
-===================
+======
 
 * Same code base as 1.20.7. This was created to test the new release process.
 
 1.20.7
-===================
+======
 
 * deps: qs@~6.16.0
 
diff --git a/package.json b/package.json
index 5b768e74..c715a7a6 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "1.20.8",
+  "version": "1.20.9",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"