CVE-2025-13466
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-24

Last updated on: 2025-11-24

Assigner: openjs

Description
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-24
Last Modified
2025-11-24
Generated
2026-06-16
AI Q&A
2025-11-24
EPSS Evaluated
2026-06-15
NVD
CVE-2025-13466
EUVD
EUVD-2025-198982
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
body-parser body-parser 2.2.0
body-parser body-parser 2.2.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in body-parser 2.2.0 is a denial of service issue caused by inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send requests containing thousands of parameters within the default 100KB request size limit, which causes elevated CPU and memory usage. This can slow down the service or cause partial outages if the malicious traffic is sustained.

Impact Analysis

This vulnerability can impact you by causing your service to slow down or partially go offline due to high CPU and memory usage triggered by malicious requests with many parameters. This can degrade the availability and performance of your application under attack.

Mitigation Strategies

Upgrade body-parser to version 2.2.1 or later, where this vulnerability is fixed. Additionally, consider implementing request size limits and parameter count limits to reduce the risk of denial of service from large URL-encoded payloads.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13466. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart