PT-2026-6810 · Adonisjs+1 · Adonisjs+1

Romain Lanz

·

Published

2026-02-06

·

Updated

2026-02-09

·

CVE-2026-25754

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions AdonisJS versions prior to 10.1.3 AdonisJS versions 11.0.0-next.0 through 11.0.0-next.8
Description A prototype pollution issue in AdonisJS multipart form-data parsing could allow a remote attacker to manipulate object prototypes during runtime. The vulnerability is limited to multipart request parsing and does not affect JSON or URL-encoded body parsing. Exploitation requires an application endpoint that accepts and parses multipart/form-data requests. If exploited, prototype pollution may lead to unexpected application behavior or logic bypasses, depending on how polluted objects are consumed. The vulnerability impacts the @adonisjs/bodyparser package through version 10.1.2 and 11.x prerelease versions prior to 11.0.0-next.9.
Recommendations Upgrade to AdonisJS version 10.1.3 or later. Upgrade to AdonisJS version 11.0.0-next.9 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-25754
GHSA-F5X2-VJ4H-VG4C

Affected Products

@Adonisjs/Bodyparser
Adonisjs