CVE-2025-13466
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads with thousands of parameters within the default 100KB limit, causing elevated CPU and memory usage.
Risk Assessment
Sustained malicious traffic can lead to service slowdown or partial outages. The risk affects Node.js applications using the vulnerable body-parser version.
Recommendation
Update body-parser to version 2.2.1, which contains the fix. Additionally, consider limiting the number of parameters in requests at the application or proxy level.
Other vulnerabilities in body-parser
See all- CVE-2026-111181High
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener; trailing bytes reach the already-finished decoder, which emits an error re-thrown as an uncaught exception that terminates the process. The issue is fixed in body-parser 2.4.0 and 1.20.9.
- CVE-2026-12590Low
In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), an invalid limit option value (e.g., unparseable string or NaN) causes bytes.parse to return null, silently skipping the request body size check. Applications relying on limit as their primary safeguard against oversized requests will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service.
Original NVD description (English source)
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS