CVE-2026-25754

Published: Feb 6, 2026Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.7

Source: security-advisories@github.com (Secondary)

Description

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

Affected (10)

Products: Adonisjs: Bodyparser

Adonisjs

1 product

Bodyparser

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Adonisjs Bodyparser	version < 10.1.3
Adonisjs Bodyparser	10.1.4 ≤ version < 11.0.0
Adonisjs Bodyparser	Version 11.0.0 next1
Adonisjs Bodyparser	Version 11.0.0 next2
Adonisjs Bodyparser	Version 11.0.0 next3
Adonisjs Bodyparser	Version 11.0.0 next4
Adonisjs Bodyparser	Version 11.0.0 next5
Adonisjs Bodyparser	Version 11.0.0 next6
Adonisjs Bodyparser	Version 11.0.0 next7
Adonisjs Bodyparser	Version 11.0.0 next8

Related CWEs

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (3)

https://github.com/adonisjs/bodyparser/commit/40e1c71f958cffb74f6b91bed6630dca979062ed

Source: security-advisories@github.com

Patch

https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9

Source: security-advisories@github.com

Release Notes

https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c

Source: security-advisories@github.com

Third Party Advisory

Timeline

No history available yet.