CVE-2025-13466
body-parser vulnerable to denial of service when url encoding is used
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
body-parser vulnerable to denial of service when url encoding is used
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
- Record
CVE-2025-13466- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/AU:Y - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-198982
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
- Record
EUVD-2025-198982- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/AU:Y - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wqch-xfxh-vrr4
body-parser is vulnerable to denial of service when url encoding is used
Impact
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic.
Patches
This issue is addressed in version 2.2.1.
- Record
GHSA-wqch-xfxh-vrr4- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
- Record
CVE-2025-13466- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
body-parser vulnerable to denial of service when url encoding is used
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
- Record
CVE-2025-13466- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/AU:Y - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-13466
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
- Record
DEBIAN-CVE-2025-13466- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVGHSA-wqch-xfxh-vrr4
body-parser is vulnerable to denial of service when url encoding is used
Impact
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic.
Patches
This issue is addressed in version 2.2.1.
- Record
GHSA-wqch-xfxh-vrr4- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2025-13466
CVE-2025-13466 in body-parser - Patched by Root
Root has patched CVE-2025-13466 in the body-parser package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2025-13466- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-13466
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
- Record
UBUNTU-CVE-2025-13466- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/AU:Y - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
body-parsernpm |
2.2.0 up to 2.2.1 | 2.2.1 |
node-body-parserDebian:14 |
before 2.2.1+~1.19.6-1, plus listed versions 1.20.3+~1.19.5-32.2.0+~1.19.6-12.2.0+~1.19.6-22.2.0+~1.19.6-3 |
2.2.1+~1.19.6-1 |
body-parserRoot:npm |
before 2.2.0-aikido.2 | 2.2.0-aikido.22.2.0-aikido.32.2.1-aikido.1 |
@rootio/body-parserRoot:npm |
before 2.2.0-root.io.2 | 2.2.0-root.io.22.2.0-root.io.32.2.1-root.io.1 |
node-body-parserUbuntu:16.04:LTS |
All versions, plus listed versions 1.8.1-1 |
None known |
node-body-parserUbuntu:18.04:LTS |
All versions, plus listed versions 1.8.1-11.8.1-1ubuntu1 |
None known |
node-body-parserUbuntu:20.04:LTS |
All versions, plus listed versions 1.18.3-21.19.0-2 |
None known |
node-body-parserUbuntu:22.04:LTS |
All versions, plus listed versions 1.19.0-21.19.0-51.19.1+~1.19.2-11.19.2+~1.19.2-1 |
None known |
node-body-parserUbuntu:24.04:LTS |
All versions, plus listed versions 1.20.1+~1.19.2-11.20.2+~1.19.5-11.20.2+~1.19.5-1build2 |
None known |
node-body-parserUbuntu:25.10 |
All versions, plus listed versions 1.20.3+~1.19.5-3 |
None known |
node-body-parserUbuntu:26.10 |
All versions, plus listed versions 2.2.2+~1.19.6-12.3.0+~1.19.6-1 |
None known |
node-body-parserUbuntu:26.04:LTS |
All versions, plus listed versions 1.20.3+~1.19.5-32.2.0+~1.19.6-12.2.2+~1.19.6-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-13466 is a medium vulnerability (CVSS 5.5) in Body-parser, published November 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in body-parser 2.2.1.
References
github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4
nvd.nist.gov/vuln/detail/CVE-2025-13466