PT-2025-47951 · Unknown+1 · Body-Parser+1

Jean Burellier + 3 · Published 2025-11-24 · Updated 2025-11-25 · CVE-2025-13466

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/AU:Y

Name of the Vulnerable Software and Affected Versions body-parser versions prior to 2.2.1

Description The software is susceptible to a denial of service condition resulting from inefficient processing of URL-encoded request bodies containing a large number of parameters. An attacker can exploit this by sending requests with thousands of parameters within the 100KB request size limit, leading to increased CPU and memory consumption. This can cause service degradation or outages when subjected to continuous malicious traffic.

Recommendations Update to version 2.2.1 or later.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-13466

GHSA-WQCH-XFXH-VRR4

Affected Products

Debian

Body-Parser

References · 15

• https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-13466 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13466 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13466 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-13466 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-13466 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13466 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-13466 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wqch-xfxh-vrr4 · Vendor Advisory
• https://github.com/expressjs/body-parser · Note
• https://github.com/expressjs/body-parser/commit/b204886a6744b0b6d297cd0e849d75de836f3b63 · Note
• https://github.com/expressjs/body-parser/releases/tag/v2.2.1 · Note
• https://twitter.com/kom_256/status/1993027855039766978 · Twitter Post
• https://t.me/CVEtracker/38108 · Telegram Post
• https://twitter.com/CVEnew/status/1993029992599507163 · Twitter Post