Parsing XML in Express: body-parser-xml vs express-xml-bodyparser vs xml2js

When building APIs that consume XML payloads — common in legacy enterprise systems, SOAP services, or government integrations — you need a reliable way to parse incoming XML into JavaScript objects. The Node.js ecosystem offers several packages for this, but they serve different roles in the request-handling pipeline. Let’s clarify what each does and how they fit together.

🧩 Core Purpose: Middleware vs Parser Library

It’s critical to understand that xml2js is not middleware — it’s a general-purpose XML-to-JS parser. In contrast, body-parser-xml and express-xml-bodyparser are Express middleware that use underlying parsers (often xml2js) to automatically parse request bodies.

xml2js: The Foundation

xml2js converts raw XML strings into JavaScript objects. It doesn’t know anything about HTTP requests — you feed it a string, and it gives you an object.

// Using xml2js directly
const xml2js = require('xml2js');

const xmlString = `<user><name>Alice</name></user>`;
xml2js.parseString(xmlString, (err, result) => {
  if (err) throw err;
  console.log(result); // { user: { name: ['Alice'] } }
});

Note: By default, xml2js wraps text content in arrays. You can customize this with options like { explicitArray: false }.

body-parser-xml: Express Middleware Built on xml2js

This package extends Express’s built-in body-parser to handle application/xml and text/xml content types. Under the hood, it uses xml2js.

// Using body-parser-xml
const express = require('express');
const bodyParserXML = require('body-parser-xml');

bodyParserXML(bodyParser); // monkey-patches body-parser

const app = express();
app.use(bodyParser.xml({
  limit: '1MB',
  xmlParseOptions: { explicitArray: false }
}));

app.post('/api/data', (req, res) => {
  console.log(req.body); // already parsed JS object
  res.sendStatus(200);
});

express-xml-bodyparser: Standalone XML Middleware

This is a self-contained Express middleware that also uses xml2js internally but doesn’t require patching body-parser.

// Using express-xml-bodyparser
const express = require('express');
const xmlBodyParser = require('express-xml-bodyparser');

const app = express();
app.use(xmlBodyParser({
  limit: '1MB',
  xmlOptions: { explicitArray: false }
}));

app.post('/api/data', (req, res) => {
  console.log(req.body); // parsed JS object
  res.sendStatus(200);
});

⚠️ Maintenance Status: Critical Consideration

As of 2024:

• body-parser-xml is deprecated. Its npm page states: "This package is no longer maintained. Please use alternatives." It hasn’t seen updates in years and relies on outdated dependencies.
• express-xml-bodyparser is also effectively unmaintained, with its last commit in 2018 and open issues about security vulnerabilities in its xml2js dependency.
• xml2js remains actively maintained, with recent releases addressing performance and security.

🛑 Do not use body-parser-xml or express-xml-bodyparser in new projects. Their reliance on old versions of xml2js exposes you to known CVEs (e.g., ReDoS vulnerabilities). Instead, write your own lightweight middleware using the latest xml2js.

🔒 Security and Configuration Control

Because the middleware packages are outdated, they lock you into old, potentially vulnerable versions of xml2js. Rolling your own middleware gives you full control:

// Secure, modern XML middleware using latest xml2js
const xml2js = require('xml2js');
const getRawBody = require('raw-body');

function xmlMiddleware(options = {}) {
  const parser = new xml2js.Parser({
    explicitArray: false,
    normalizeTags: true,
    ...options.xmlOptions
  });

  return async (req, res, next) => {
    if (!/^(application|text)\/xml/i.test(req.headers['content-type'])) {
      return next();
    }

    try {
      const raw = await getRawBody(req, {
        limit: options.limit || '1mb',
        encoding: 'utf8'
      });
      req.body = await parser.parseStringPromise(raw);
      next();
    } catch (err) {
      next(err);
    }
  };
}

// Usage
app.use(xmlMiddleware({ limit: '2mb', xmlOptions: { explicitArray: false } }));

This approach lets you:

• Use the latest xml2js with security patches
• Customize parsing behavior precisely
• Handle errors gracefully
• Avoid deprecated dependencies

📦 When You Actually Need xml2js Alone

Sometimes you don’t need middleware at all. Examples:

• Parsing XML from a file:

  const fs = require('fs');
  const xml2js = require('xml2js');
  const parser = new xml2js.Parser();
  const xml = fs.readFileSync('data.xml', 'utf8');
  const result = await parser.parseStringPromise(xml);
  

• Consuming an XML API response in a service:

  const axios = require('axios');
  const xml2js = require('xml2js');
  
  const { data } = await axios.get('https://api.example.com/data.xml');
  const parser = new xml2js.Parser();
  const jsObj = await parser.parseStringPromise(data);
  

In these cases, xml2js is the right and only tool you need.

🔄 Migration Path from Deprecated Middleware

If you’re maintaining a legacy app using express-xml-bodyparser, migrate like this:

1. Install latest xml2js and raw-body:

   npm install xml2js raw-body
   

2. Replace the middleware with the custom one shown above.

3. Update parsing options to match your current behavior (e.g., explicitArray: false).

4. Add proper error handling for malformed XML.

💡 Summary: What Should You Use?

🎯 Final Advice

• For new Express apps: Write a small XML middleware using the latest xml2js and raw-body. It’s ~15 lines of code and gives you full control.
• For non-Express use cases (files, API clients): Use xml2js directly.
• Never pull in deprecated middleware just to save a few lines — the security and maintenance debt isn’t worth it.

Remember: XML parsing is a solved problem, but the integration layer (middleware) is where most risks live. Keep it simple, keep it updated, and own your stack.