CVE-2025-13466 Details
Description
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
A denial-of-service vulnerability has been identified in body-parser version 2.2.0. The issue arises from the library's inefficient processing of URL-encoded bodies that contain a large number of parameters. An attacker can exploit this vulnerability by sending payloads with thousands of parameters, within the default 100KB request size limit. This exploitation leads to increased CPU and memory usage, causing service slowdowns or partial outages under sustained malicious traffic.
Users can upgrade to body-parser version 2.2.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 24, 2025CISA-ADP
Assessed Nov 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4 | openjs | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | openjs |
Affected Products
| Product | Versions |
|---|---|
| expressjs body-parser | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 24, 2025 | New CVE Received | openjs |