{"id":"EUVD-2025-198982","enisaUuid":"83a790ef-b76d-33ed-a8d2-1856a9339e1d","description":"body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic.\nThis issue is addressed in version 2.2.1.","datePublished":"Nov 24, 2025, 6:29:36 PM","dateUpdated":"Nov 24, 2025, 6:57:00 PM","baseScore":5.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/AU:Y","references":"https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4\n","aliases":"CVE-2025-13466\nGHSA-wqch-xfxh-vrr4\n","assigner":"openjs","epss":0.39,"enisaIdProduct":[{"id":"6e715418-abbf-32b1-b03d-2c2962f905a2","product":{"name":"body-parser","vendor":{"name":"body-parser"}},"product_version":"2.2.0"}],"enisaIdVendor":[{"id":"22ee7508-a998-35bd-b10b-7aa005321b01","vendor":{"name":"body-parser"}}],"enisaIdVulnerability":[{"id":"42833fc1-38fa-3f98-9162-646de79a8fce","vulnerability":{"id":"GHSA-wqch-xfxh-vrr4","description":"body-parser is vulnerable to denial of service when url encoding is used","datePublished":"Nov 25, 2025, 2:20:21 PM","dateUpdated":"Nov 25, 2025, 6:09:52 PM","baseScore":0.0,"references":"https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-13466\nhttps://github.com/expressjs/body-parser/commit/b204886a6744b0b6d297cd0e849d75de836f3b63\nhttps://github.com/expressjs/body-parser\nhttps://github.com/expressjs/body-parser/releases/tag/v2.2.1\n","enisa_id":"EUVD-2025-198982\n","aliases":"GHSA-wqch-xfxh-vrr4\nCVE-2025-13466\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ba7f5fc2-f477-368c-900a-e68aea7a0e85","vulnerability":{"id":"CVE-2025-13466","description":"body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic.\nThis issue is addressed in version 2.2.1.","datePublished":"Nov 24, 2025, 6:29:36 PM","dateUpdated":"Nov 24, 2025, 6:57:00 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/AU:Y","references":"https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4\n","enisa_id":"EUVD-2025-198982\n","assigner":"openjs","epss":0.39,"dataProcessed":"Oct 27, 2026, 7:17:47 AM","vulnerabilityProduct":[{"id":"73f81e2e-109f-3b0a-92f6-225eb36b4379","product":{"name":"body-parser","vendor":{"name":"body-parser"}},"product_version":"2.2.0"}],"vulnerabilityVendor":[{"id":"35609843-4c7b-3e5c-9b69-bdbf8438a144","vendor":{"name":"body-parser"}}]}}],"enisaIdAdvisory":[{"id":"0b8ece20-c3fd-3a22-9cd1-8cf333dba172","advisory":{"id":"WID-SEC-W-2025-2909","description":"IBM App Connect Enterprise: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Dec 22, 2025, 11:00:00 PM","dateUpdated":"Feb 5, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2909.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-2909\n","aliases":"CVE-2025-13466\nCVE-2025-64718\nCVE-2025-64756\nCVE-2025-65945\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"0de5e474-dc2e-3702-a3e0-24d52ca22e63","product":{"name":"IBM App Connect Enterprise \u003c12.0.12.21","vendor":{"name":"IBM"}}},{"id":"194abee6-1601-312f-a57b-b511b81d9c0f","product":{"name":"12.0.12.21","vendor":{"name":"IBM"}}},{"id":"216d5638-14c0-3a53-95db-fd0ae1eb015b","product":{"name":"IBM App Connect Enterprise 12.0.12.21","vendor":{"name":"IBM"}}},{"id":"a18baf87-3b44-37aa-9b7a-d5f63e0db6ff","product":{"name":"13.0.6.0","vendor":{"name":"IBM"}}},{"id":"a5d5f04e-ecea-319d-891a-c8deeb0cddc8","product":{"name":"IBM App Connect Enterprise 13.0.6.0","vendor":{"name":"IBM"}}},{"id":"bddb9475-e9bb-3750-bd96-e7a21e12f1ef","product":{"name":"IBM App Connect Enterprise \u003c13.0.6.0","vendor":{"name":"IBM"}}},{"id":"dcde4bec-e95b-3ebb-806f-14b3a8c4717a","product":{"name":"App Connect Enterprise","vendor":{"name":"IBM"}}},{"id":"df5101cc-ab77-3072-95ce-78d2f228bc31","product":{"name":"IBM App Connect Enterprise","vendor":{"name":"IBM"}}}]}}]}