CVE-2025-13466: body-parser Denial of Service Vulnerability Due to Inefficient URL Encoding Handling
Summary
CVE-2025-13466: body-parser is vulnerable to denial of service when url encoding is used. Affects body-parser versions < 2.2.1. Fixed in 2.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
body-parser is a middleware for Node.js that parses incoming request bodies in a middleware before your handlers, available under the req.body property. It supports various content types, including JSON and URL-encoded data. The package is widely used in web applications to handle form submissions and API requests. However, version 2.2.0 of body-parser is vulnerable to a denial of service (DoS) attack when handling URL-encoded bodies with a large number of parameters, which can lead to performance degradation and service outages.
Vulnerability Detail
The vulnerability arises from the inefficient handling of URL-encoded bodies that contain an excessive number of parameters. An attacker can exploit this by sending requests with thousands of parameters, exceeding the default request size limit of 100KB. This can cause elevated CPU and memory usage, leading to slowdowns or partial outages of the service under sustained malicious traffic. The vulnerability is classified under CWE-400, which pertains to the resource exhaustion.
How To Fix
Latest published version: 2.4.0 as of 22 Oct 2026
npm install body-parser@2.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.1
This is the first release that contains the fix.
npm install body-parser@2.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the number of parameters accepted in URL-encoded requests or implement rate limiting on your API endpoints to mitigate the impact of potential attacks. However, the best solution is to update to the patched version.
Conclusion
The body-parser package version 2.2.0 is vulnerable to a denial of service attack due to inefficient handling of URL-encoded bodies. It is crucial to update to version 2.2.1 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for body-parser →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Version 2.2.0 of body-parser is affected. The vulnerability is fixed in version 2.2.1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The potential impacts include service slowdowns and partial outages due to elevated CPU and memory usage when handling malicious requests.
Yes, you can implement rate limiting or restrict the number of parameters in requests as a temporary measure, but updating to the patched version is the best solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for body-parser.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
