CVE-2025-13466: body-parser DoS Vulnerability

CVE-2025-13466 Overview

CVE-2025-13466 is a denial-of-service vulnerability in body-parser version 2.2.0, a widely used middleware for parsing incoming request bodies in Express.js applications. The flaw stems from inefficient handling of URL-encoded bodies containing very large numbers of parameters. Attackers can craft payloads containing thousands of parameters within the default 100KB request size limit, driving elevated CPU and memory consumption on the target server. Sustained malicious traffic can cause service slowdowns or partial outages. The issue is fixed in body-parser version 2.2.1.

Critical Impact
Unauthenticated remote attackers can degrade availability of Node.js services by sending crafted URL-encoded payloads that exhaust CPU and memory resources within default request size limits.

Affected Products

body-parser 2.2.0 (npm package maintained by the Express.js team)
Node.js applications that depend on body-parser 2.2.0 for URL-encoded body parsing
Express.js applications indirectly using the affected body-parser version

Discovery Timeline

2025-11-24 - CVE-2025-13466 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13466

Vulnerability Analysis

The vulnerability is classified as Uncontrolled Resource Consumption [CWE-400]. The body-parser middleware processes application/x-www-form-urlencoded request bodies and converts them into JavaScript objects. In version 2.2.0, the parsing routine handles bodies with a very large number of parameters inefficiently. Even when the total body size stays under the default 100KB limit, an attacker can pack thousands of small key-value pairs into a single request. The parser then performs work that scales poorly with parameter count, driving CPU and memory usage upward per request.

The attack does not require authentication, user interaction, or elevated privileges. A single event-loop-blocked worker degrades responsiveness for concurrent clients on the same Node.js process, and repeated requests amplify the impact across the service.

Root Cause

The root cause is algorithmic inefficiency in the URL-encoded body parsing path when the parameter count is high. The default 100KB request-size cap does not bound parameter count, so the size-based safeguard alone is insufficient to constrain processing cost. Version 2.2.1 addresses the issue by improving how parameters are enumerated and processed.

Attack Vector

An unauthenticated attacker sends HTTP POST requests with Content-Type: application/x-www-form-urlencoded to any endpoint that uses the affected middleware. The body contains a large number of short parameter pairs (for example, a1=1&a2=1&...&aN=1) crafted to remain under the default size limit while maximizing parameter count. Each request consumes disproportionate CPU cycles and memory, and sustained traffic degrades or interrupts service availability. Refer to the GitHub Security Advisory GHSA-wqch-xfxh-vrr4 for technical details.

Detection Methods for CVE-2025-13466

Indicators of Compromise

HTTP POST requests with Content-Type: application/x-www-form-urlencoded containing an unusually high number of parameters relative to normal application traffic.
Request bodies approaching the 100KB limit that consist of many short key-value pairs.
Repeated bursts of similar URL-encoded payloads from the same source IP or IP range.

Detection Strategies

Inspect access logs for POST requests with body sizes near the parser's configured limit and abnormally high parameter counts.
Add web application firewall (WAF) rules that count & separators in URL-encoded bodies and flag requests exceeding a defined parameter threshold.
Correlate spikes in Node.js event-loop lag or CPU saturation with concurrent inbound POST traffic patterns.

Monitoring Recommendations

Track per-endpoint request latency, CPU utilization, and heap growth for services that accept URL-encoded input.
Alert on sustained event-loop delay exceeding normal baselines on Node.js workers.
Monitor npm dependency inventories for body-parser 2.2.0 and generate alerts when the vulnerable version is detected in production builds.

How to Mitigate CVE-2025-13466

Immediate Actions Required

Upgrade body-parser to version 2.2.1 or later across all Node.js and Express.js services.
Audit application dependency trees using npm ls body-parser to identify transitive uses of the vulnerable version.
Deploy WAF or reverse-proxy rules to limit parameter counts in URL-encoded bodies until patching is complete.

Patch Information

The maintainers released body-parser 2.2.1, which resolves the inefficient parameter handling behavior. See the GitHub Security Advisory GHSA-wqch-xfxh-vrr4 for release notes and remediation details. Update the package via the standard package manager workflow and redeploy affected services.

Workarounds

Reduce the body-parserurlencodedlimit option below the default 100KB for endpoints that do not require large form submissions.
Set the parameterLimit option on urlencoded() to a conservative value (for example, 100 or 1000) to bound the number of parameters processed per request.
Place a rate-limiting proxy or WAF in front of Node.js services to throttle abusive clients and reject bodies with excessive parameter counts.

bash

# Configuration example
npm install body-parser@2.2.1

# Express.js middleware configuration limiting parameter count and body size
# app.use(bodyParser.urlencoded({ extended: false, limit: '10kb', parameterLimit: 1000 }));