# CVE-2025-13466: body-parser denial of service in URL encoding

Source: https://junglewise.ai/threats/cve-2025-13466-body-parser-denial-of-service-in-url-encoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-13466 · Severity: low · CVSS 3.1 · Published 2025-11-24

body-parser is a middleware library used in Node.js web applications to parse incoming request bodies. Version 2.2.0 has a vulnerability where attackers can send specially crafted requests with thousands of URL-encoded parameters to exhaust server CPU and memory, causing service slowdown or partial outages. The attack requires no authentication and can be triggered with normal-sized requests.

Technologies: [Body-Parser](https://junglewise.ai/threats/technologies/npm-body-parser).

## Quick answers

**Is CVE-2025-13466 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13466 being exploited in the wild.

**How severe is CVE-2025-13466?** Low severity, with a CVSS score of 3.1, published 24 November 2025.

**Which products and versions are affected?** Body-Parser SEMVER:introduced=2.2.0,fixed=2.2.1.

**Is there a fix for CVE-2025-13466?** Yes. Body-Parser: upgrade to 2.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-13466 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-13466?** Check whether you run Body-Parser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Body-Parser: upgrade to 2.2.1 or later

## Technical details

body-parser 2.2.0 contains a denial of service vulnerability in URL-encoded request body handling due to inefficient parameter parsing. The vulnerability allows attackers to craft payloads with thousands of URL-encoded parameters within the default 100KB request size limit, causing disproportionate CPU and memory consumption. The attack vector is network-based with no authentication or user interaction required. Successful exploitation results in service degradation or partial outages under sustained attack. The issue is classified as uncontrolled resource consumption (CWE-400) and is patched in version 2.2.1.

## Affected products

- Express.js body-parser 2.2.0

## Identifiers

- CVE-2025-13466
- GHSA-wqch-xfxh-vrr4

## Timeline

- 2025-11-25: disclosed
- 2025-11-25: patched: Fixed in version 2.2.1

## References

- [https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4](https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4)

## Related threats

- [Express.js body-parser denial of service via decompression stream](https://junglewise.ai/threats/cve-2026-111181-body-parser-is-body-parsing-middleware-for-node-js-and-express)
- [OpenJS body-parser denial of service via invalid limit configuration](https://junglewise.ai/threats/cve-2026-12590-openjs-body-parser-denial-of-service-via-invalid-limit)
- [body-parser denial of service in URL encoding](https://junglewise.ai/threats/cve-2024-45590-body-parser-denial-of-service-in-url-encoding)