PT-2026-6811 · Unknown+1 · @Adonisjs/Bodyparser+1

Zeroxjacks · Publicado 2026-02-06 · Atualizado 2026-02-09 · CVE-2026-25762

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AdonisJS versions prior to 10.1.3 AdonisJS versions prior to 11.0.0-next.9

Description A denial of service (DoS) issue exists in the multipart file handling logic of the @adonisjs/bodyparser package. The multipart parser may accumulate an unbounded amount of data in memory when attempting to detect file types, potentially leading to excessive memory consumption and process termination.

Recommendations Update to AdonisJS version 10.1.3 or later. Update to AdonisJS version 11.0.0-next.9 or later.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Enumeração de Fraquezas

CWE-770

CWE-400

Identificadores relacionados

CVE-2026-25762

GHSA-XX9G-FH25-4Q64

Produtos afetados

@Adonisjs/Bodyparser

Adonisjs

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25762.json · Exploit
• https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64 · Nota
• https://github.com/adonisjs/core · Nota
• https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9 · Nota
• https://github.com/adonisjs/bodyparser/releases/tag/v10.1.3 · Nota
• https://reddit.com/r/VulnMatter/comments/1r03p4y/resumen_diario_de_vulnerabilidades_09022026 · Publicação no Reddit
• https://twitter.com/CVEnew/status/2019914476758392948 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-xx9g-fh25-4q64 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-25762 · Aviso do Fabricante
• https://twitter.com/_cvereports/status/2020296544457466345 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25762 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1r03op1/resumen_diario_de_vulnerabilidades_09022026 · Publicação no Reddit