CVE-2025-13466 body-parser vulnerable to denial of service when url encoding is used
An attacker can cause denial of service in applications using body-parser by sending URL-encoded requests with excessive parameters, leading to resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13466?
CVE-2025-13466 is a medium-severity denial of service vulnerability in body-parser, published on 24 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.
Weakness: CWE-400
Which versions are affected by CVE-2025-13466?
2 open source packages ship an affected version, including body-parser.
| Package | Affected | Fixed in |
|---|---|---|
body-parser npm | From 2.2.0 | 2.2.1 |
body-parser npm | From 2.2.0 | 2.2.1 |
How do I fix CVE-2025-13466?
Upgrade body-parser to 2.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-13466 being exploited?
There is no known exploitation of CVE-2025-13466 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-SS80310, DEBIAN-CVE-2025-13466, GHSA-wqch-xfxh-vrr4, MINI-hfpq-8vmj-5px2, MINI-mg9m-mm9c-mr2r, MINI-rpgf-xhrq-jcc8 and 2 more.