AdonisJS multipart body parsing has Prototype Pollution issue
Priority LOW 38CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed core (adonisjs): 10.1.3, 11.0.0-next.9@adonisjs/bodyparser (npm): 10.1.3, 11.0.0-next.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| adonisjs | core | before 10.1.3; before 11.0.0-next.9 | 10.1.3, 11.0.0-next.9 | Patch available | CNA |
| — | @adonisjs/bodyparser (npm) | before 10.1.3 | 10.1.3 | Patch available | GHSA-f5x2-vj4h-vg4c |
| — | @adonisjs/bodyparser (npm) | 11.0.0-next.0 to before 11.0.0-next.9 | 11.0.0-next.9 | Patch available | GHSA-f5x2-vj4h-vg4c |
- core Vendoradonisjs Affected before 10.1.3; before 11.0.0-next.9 Fixed in 10.1.3, 11.0.0-next.9 Patch available CNA
- @adonisjs/bodyparser (npm) Vendor— Affected before 10.1.3 Fixed in 10.1.3 Patch available GHSA-f5x2-vj4h-vg4c
- @adonisjs/bodyparser (npm) Vendor— Affected 11.0.0-next.0 to before 11.0.0-next.9 Fixed in 11.0.0-next.9 Patch available GHSA-f5x2-vj4h-vg4c
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:adonisjs:bodyparser:*:*:*:*:*:node.js:*:* | before 10.1.3; 10.1.4 to before 11.0.0 | Vulnerable | adonisjs |
| cpe:2.3:a:adonisjs:bodyparser:11.0.0:next1:*:*:*:node.js:*:* | 11.0.0 next1 | Vulnerable | adonisjs |
| cpe:2.3:a:adonisjs:bodyparser:11.0.0:next2:*:*:*:node.js:*:* | 11.0.0 next2 | Vulnerable | adonisjs |
| cpe:2.3:a:adonisjs:bodyparser:11.0.0:next3:*:*:*:node.js:*:* | 11.0.0 next3 | Vulnerable | adonisjs |
| cpe:2.3:a:adonisjs:bodyparser:11.0.0:next4:*:*:*:node.js:*:* | 11.0.0 next4 | Vulnerable | adonisjs |
| cpe:2.3:a:adonisjs:bodyparser:11.0.0:next5:*:*:*:node.js:*:* | 11.0.0 next5 | Vulnerable | adonisjs |
| cpe:2.3:a:adonisjs:bodyparser:11.0.0:next6:*:*:*:node.js:*:* | 11.0.0 next6 | Vulnerable | adonisjs |
| cpe:2.3:a:adonisjs:bodyparser:11.0.0:next7:*:*:*:node.js:*:* | 11.0.0 next7 | Vulnerable | adonisjs |
| cpe:2.3:a:adonisjs:bodyparser:11.0.0:next8:*:*:*:node.js:*:* | 11.0.0 next8 | Vulnerable | adonisjs |
- cpe:2.3:a:adonisjs:bodyparser:*:*:*:*:*:node.js:*:* Versions before 10.1.3; 10.1.4 to before 11.0.0 Vulnerable ·adonisjs
- cpe:2.3:a:adonisjs:bodyparser:11.0.0:next1:*:*:*:node.js:*:* Versions 11.0.0 next1 Vulnerable ·adonisjs
- cpe:2.3:a:adonisjs:bodyparser:11.0.0:next2:*:*:*:node.js:*:* Versions 11.0.0 next2 Vulnerable ·adonisjs
- cpe:2.3:a:adonisjs:bodyparser:11.0.0:next3:*:*:*:node.js:*:* Versions 11.0.0 next3 Vulnerable ·adonisjs
- cpe:2.3:a:adonisjs:bodyparser:11.0.0:next4:*:*:*:node.js:*:* Versions 11.0.0 next4 Vulnerable ·adonisjs
- cpe:2.3:a:adonisjs:bodyparser:11.0.0:next5:*:*:*:node.js:*:* Versions 11.0.0 next5 Vulnerable ·adonisjs
- cpe:2.3:a:adonisjs:bodyparser:11.0.0:next6:*:*:*:node.js:*:* Versions 11.0.0 next6 Vulnerable ·adonisjs
- cpe:2.3:a:adonisjs:bodyparser:11.0.0:next7:*:*:*:node.js:*:* Versions 11.0.0 next7 Vulnerable ·adonisjs
- cpe:2.3:a:adonisjs:bodyparser:11.0.0:next8:*:*:*:node.js:*:* Versions 11.0.0 next8 Vulnerable ·adonisjs
Remediation
- Fix · CNA core (adonisjs) Fixed in 10.1.3, 11.0.0-next.9
- Fix · GHSA-f5x2-vj4h-vg4c @adonisjs/bodyparser (npm) Fixed in 10.1.3 Advisory →
- Fix · GHSA-f5x2-vj4h-vg4c @adonisjs/bodyparser (npm) Fixed in 11.0.0-next.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25754
- 2026-10-03 Alias added: GHSA-f5x2-vj4h-vg4c
References
Advisory 2
More adonisjs Bodyparser vulnerabilities
- TI-2026-20829 Uncontrolled resource consumption in adonisjs core CVSS 3.1HIGH 7.5
Sources
- CVE-2026-25754 · CVE Program
- CVE-2026-25754 · NVD
- FIRST EPSS
- GHSA-f5x2-vj4h-vg4c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences