body-parser is vulnerable to denial of service when url encoding is used
GHSA-wqch-xfxh-vrr4 · CVE-2025-13466
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic.
Patches
This issue is addressed in version 2.2.1.
References
- WEB https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-13466
- WEB https://github.com/expressjs/body-parser/commit/b204886a6744b0b6d297cd0e849d75de836f3b63
- PACKAGE https://github.com/expressjs/body-parser
- WEB https://github.com/expressjs/body-parser/releases/tag/v2.2.1
Ready to move
Start Securing
Free, no credit card | First findings in minutes