Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-13466

Good to know:

icon
icon
icon

Date: November 24, 2025

body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.

Severity Score

Related Resources (6)

https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4
https://github.com/expressjs/body-parser/releases/tag/v2.2.1
https://nvd.nist.gov/vuln/detail/CVE-2025-13466
https://github.com/expressjs/body-parser/commit/b204886a6744b0b6d297cd0e849d75de836f3b63
https://github.com/expressjs/body-parser
https://www.mend.io/vulnerability-database/CVE-2025-13466

Severity Score

Weakness Type (CWE)

Uncontrolled Resource Consumption

CWE-400

Top Fix

icon

Upgrade Version

Upgrade to version body-parser - 2.2.1;https://github.com/expressjs/body-parser.git - v2.2.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): LOW

Do you need more information?

Contact Us