CVE-2025-13466

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-13466
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13466.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-13466
Aliases
Downstream
Related
Published
2025-11-24T18:29:36.725Z
Modified
2026-07-15T01:48:54.925884652Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/AU:Y CVSS Calculator
Summary
body-parser vulnerable to denial of service when url encoding is used
Details

body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.

Database specific 
{
    "cna_assigner": "openjs",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13466.json"
}
References

Affected packages

Git / github.com/expressjs/body-parser

Affected ranges

Type
GIT
Repo
https://github.com/expressjs/body-parser
Events
Introduced
0aa4e1128ef88c7f68a851a44c6adbbed35dbfd4
Last affected
0aa4e1128ef88c7f68a851a44c6adbbed35dbfd4
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.2.0"
        },
        {
            "last_affected": "2.2.0"
        }
    ]
}

Affected versions

2.*
2.2.0
v2.*
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13466.json"