Medium severity · published Nov 24, 2025
CVE-2025-13466
body-parser vulnerable to denial of service when url encoding is used
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic.
This issue is addressed in version 2.2.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
body-parser · body-parser
2.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13466
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13466
github.com
https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4
More from body-parser
7.5
CVE-2026-111181
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
5.9
CVE-2026-12590
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement