PT-2025-47951

CVE-2025-13466

Published

2025-11-24

Updated

2026-09-01

Description by

CVSS 4.0

5.5

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions body-parser versions prior to 2.2.1

Description The software is susceptible to a denial of service condition resulting from inefficient processing of URL-encoded request bodies containing a large number of parameters. An attacker can exploit this by sending requests with thousands of parameters within the 100KB request size limit, leading to increased CPU and memory consumption. This can cause service degradation or outages when subjected to continuous malicious traffic.

Recommendations Update to version 2.2.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers