Good catch on the 'no matching route' detail - that's the part most write-ups skip. A request that never reaches a handler still passes through the global middleware stack, so a parser bug becomes a pre-routing crash, which is why path-based WAF rules don't help here. Two cheap complements to patching: pin the fixed versions in package-lock (transitive pulls of body-parser through older Express releases are the usual way this stays vulnerable), and run the process under a supervisor with a restart limit - otherwise a crash loop turns a recoverable DoS into a permanent outage. Updating the library is the fix; the rest just decides how loud the failure is while you deploy it.