Read the docs
TI-2026-20829 Aliases CVE-2026-25762GHSA-xx9g-fh25-4q64

Uncontrolled resource consumption in adonisjs core

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00534 45th percentileScored 2026-11-07
Fix Fixed core (adonisjs): 10.1.3, 11.0.0-next.9@adonisjs/bodyparser (npm): 10.1.3, 11.0.0-next.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
adonisjscorebefore 10.1.3; before 11.0.0-next.910.1.3, 11.0.0-next.9Patch availableCNA
—@adonisjs/bodyparser (npm)before 10.1.310.1.3Patch availableGHSA-xx9g-fh25-4q64
—@adonisjs/bodyparser (npm)11.0.0-next.0 to before 11.0.0-next.911.0.0-next.9Patch availableGHSA-xx9g-fh25-4q64
  • core Vendoradonisjs Affected before 10.1.3; before 11.0.0-next.9 Fixed in 10.1.3, 11.0.0-next.9 Patch available CNA
  • @adonisjs/bodyparser (npm) Vendor— Affected before 10.1.3 Fixed in 10.1.3 Patch available GHSA-xx9g-fh25-4q64
  • @adonisjs/bodyparser (npm) Vendor— Affected 11.0.0-next.0 to before 11.0.0-next.9 Fixed in 11.0.0-next.9 Patch available GHSA-xx9g-fh25-4q64

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:adonisjs:bodyparser:*:*:*:*:*:node.js:*:*before 10.1.3; 10.1.4 to before 11.0.0Vulnerableadonisjs
cpe:2.3:a:adonisjs:bodyparser:11.0.0:next1:*:*:*:node.js:*:*11.0.0 next1Vulnerableadonisjs
cpe:2.3:a:adonisjs:bodyparser:11.0.0:next2:*:*:*:node.js:*:*11.0.0 next2Vulnerableadonisjs
cpe:2.3:a:adonisjs:bodyparser:11.0.0:next3:*:*:*:node.js:*:*11.0.0 next3Vulnerableadonisjs
cpe:2.3:a:adonisjs:bodyparser:11.0.0:next4:*:*:*:node.js:*:*11.0.0 next4Vulnerableadonisjs
cpe:2.3:a:adonisjs:bodyparser:11.0.0:next5:*:*:*:node.js:*:*11.0.0 next5Vulnerableadonisjs
cpe:2.3:a:adonisjs:bodyparser:11.0.0:next6:*:*:*:node.js:*:*11.0.0 next6Vulnerableadonisjs
cpe:2.3:a:adonisjs:bodyparser:11.0.0:next7:*:*:*:node.js:*:*11.0.0 next7Vulnerableadonisjs
cpe:2.3:a:adonisjs:bodyparser:11.0.0:next8:*:*:*:node.js:*:*11.0.0 next8Vulnerableadonisjs
  • cpe:2.3:a:adonisjs:bodyparser:*:*:*:*:*:node.js:*:* Versions before 10.1.3; 10.1.4 to before 11.0.0 Vulnerable ·adonisjs
  • cpe:2.3:a:adonisjs:bodyparser:11.0.0:next1:*:*:*:node.js:*:* Versions 11.0.0 next1 Vulnerable ·adonisjs
  • cpe:2.3:a:adonisjs:bodyparser:11.0.0:next2:*:*:*:node.js:*:* Versions 11.0.0 next2 Vulnerable ·adonisjs
  • cpe:2.3:a:adonisjs:bodyparser:11.0.0:next3:*:*:*:node.js:*:* Versions 11.0.0 next3 Vulnerable ·adonisjs
  • cpe:2.3:a:adonisjs:bodyparser:11.0.0:next4:*:*:*:node.js:*:* Versions 11.0.0 next4 Vulnerable ·adonisjs
  • cpe:2.3:a:adonisjs:bodyparser:11.0.0:next5:*:*:*:node.js:*:* Versions 11.0.0 next5 Vulnerable ·adonisjs
  • cpe:2.3:a:adonisjs:bodyparser:11.0.0:next6:*:*:*:node.js:*:* Versions 11.0.0 next6 Vulnerable ·adonisjs
  • cpe:2.3:a:adonisjs:bodyparser:11.0.0:next7:*:*:*:node.js:*:* Versions 11.0.0 next7 Vulnerable ·adonisjs
  • cpe:2.3:a:adonisjs:bodyparser:11.0.0:next8:*:*:*:node.js:*:* Versions 11.0.0 next8 Vulnerable ·adonisjs

Remediation

  • Fix · CNA core (adonisjs) Fixed in 10.1.3, 11.0.0-next.9
  • Fix · GHSA-xx9g-fh25-4q64 @adonisjs/bodyparser (npm) Fixed in 10.1.3 Advisory →
  • Fix · GHSA-xx9g-fh25-4q64 @adonisjs/bodyparser (npm) Fixed in 11.0.0-next.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25762
  2. 2026-10-03 Alias added: GHSA-xx9g-fh25-4q64
  3. 2026-10-04 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 2

Other 3

  • TI-2026-20822 AdonisJS multipart body parsing has Prototype Pollution issue CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences