Executive brief
body-parser is a middleware library used in Node.js web applications to parse incoming request bodies. Version 2.2.0 has a vulnerability where attackers can send specially crafted requests with thousands of URL-encoded parameters to exhaust server CPU and memory, causing service slowdown or partial outages. The attack requires no authentication and can be triggered with normal-sized requests.
Technical details
body-parser 2.2.0 contains a denial of service vulnerability in URL-encoded request body handling due to inefficient parameter parsing. The vulnerability allows attackers to craft payloads with thousands of URL-encoded parameters within the default 100KB request size limit, causing disproportionate CPU and memory consumption. The attack vector is network-based with no authentication or user interaction required. Successful exploitation results in service degradation or partial outages under sustained attack. The issue is classified as uncontrolled resource consumption (CWE-400) and is patched in version 2.2.1.
Affected products
- Express.js body-parser 2.2.0
Timeline
- 2025-11-25: disclosed
- 2025-11-25: patched: Fixed in version 2.2.1