Deploying an Express 5 app as a single Netlify Function (via serverless-http), I learned that req.body can arrive in one of three broken states depending on how the platform hands over the request: already-parsed object, raw unparsed bytes, or a base64-encoded string — and body-parser 2 doesn’t normalize them the way it did requests from a real socket.
The fix that held up: a fallback middleware after the normal express.json() that detects a missing/mangled body and re-parses from the raw bytes (decoding base64 first when the event flags it).
The general lesson: Express-on-Lambda is not Express-on-a-socket. The middlewares you trust were written for one transport, and the serverless wrapper is a second transport wearing its clothes. Test the actual deployed function with real POSTs, not just local dev — locally everything works, which is exactly the trap.