GitHub Advisoryadvisory · npm

GHSA-wqch-xfxh-vrr4 body-parser is vulnerable to denial of service when url encoding is used

MEDIUM Published 2025-11-25 Modified 2025-11-25 Official page ↗
Aliases
CVE-2025-13466
Ecosystem
npm
Packages
body-parser
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2025-11-25

Affected packages

• npm body-parser: >= 2.2.0, < 2.2.1 → fixed in 2.2.1

Description

Impact body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. Patches This issue is addressed in version 2.2.1.

Related

Alias · CVE (1)

  • CVE-2025-13466 body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References