CVE-2025-13466: body-parser vulnerable to denial of service when url encoding is used
### Impact body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. ### Patches This issue is addressed in version 2.2.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13466?
CVE-2025-13466 has been classified as a denial of service vulnerability due to inefficient handling of URL-encoded bodies.
What software is affected by CVE-2025-13466?
CVE-2025-13466 affects the body-parser library, specifically version 2.2.0.
How does CVE-2025-13466 allow for denial of service attacks?
CVE-2025-13466 allows attackers to send payloads with a high number of parameters, which can consume excessive CPU and memory resources.
How do I fix CVE-2025-13466?
To fix CVE-2025-13466, update the body-parser library to a version that addresses the vulnerability as soon as it becomes available.
What can happen if CVE-2025-13466 is exploited?
If exploited, CVE-2025-13466 can lead to service interruptions and degraded performance due to resource exhaustion.