PT-2026-6811 · Unknown+1 · @Adonisjs/Bodyparser+1

Zeroxjacks · Published 2026-02-06 · Updated 2026-02-09 · CVE-2026-25762

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AdonisJS versions prior to 10.1.3 AdonisJS versions prior to 11.0.0-next.9

Description A denial of service (DoS) issue exists in the multipart file handling logic of the @adonisjs/bodyparser package. The multipart parser may accumulate an unbounded amount of data in memory when attempting to detect file types, potentially leading to excessive memory consumption and process termination.

Recommendations Update to AdonisJS version 10.1.3 or later. Update to AdonisJS version 11.0.0-next.9 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-25762

GHSA-XX9G-FH25-4Q64

Affected Products

@Adonisjs/Bodyparser

Adonisjs

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25762.json · Exploit
• https://osv.dev/vulnerability/GHSA-xx9g-fh25-4q64 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25762 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25762 · Security Note
• https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64 · Note
• https://github.com/adonisjs/core · Note
• https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9 · Note
• https://github.com/adonisjs/bodyparser/releases/tag/v10.1.3 · Note
• https://reddit.com/r/VulnMatter/comments/1r03p4y/resumen_diario_de_vulnerabilidades_09022026 · Reddit Post
• https://twitter.com/CVEnew/status/2019914476758392948 · Twitter Post
• https://twitter.com/_cvereports/status/2020296544457466345 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r03op1/resumen_diario_de_vulnerabilidades_09022026 · Reddit Post