PT-2026-6811 · Adonisjs+1 · Adonisjs+1

Zeroxjacks · CVE-2026-25762 · Published 2026-02-06 · Updated 2026-02-09

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AdonisJS versions prior to 10.1.3 AdonisJS versions prior to 11.0.0-next.9

Description A denial of service (DoS) issue exists in the multipart file handling logic of the @adonisjs/bodyparser package. The multipart parser may accumulate an unbounded amount of data in memory when attempting to detect file types, potentially leading to excessive memory consumption and process termination.

Recommendations Update to AdonisJS version 10.1.3 or later. Update to AdonisJS version 11.0.0-next.9 or later.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-25762

GHSA-XX9G-FH25-4Q64

Affected Products

@Adonisjs/Bodyparser

Adonisjs

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25762.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-25762 · Security Note
• https://osv.dev/vulnerability/GHSA-xx9g-fh25-4q64 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25762 · Vendor Advisory
• https://github.com/adonisjs/core · Note
• https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64 · Note
• https://github.com/adonisjs/bodyparser/releases/tag/v10.1.3 · Note
• https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9 · Note
• https://twitter.com/CVEnew/status/2019914476758392948 · Twitter Post
• https://twitter.com/_cvereports/status/2020296544457466345 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r03p4y/resumen_diario_de_vulnerabilidades_09022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r03op1/resumen_diario_de_vulnerabilidades_09022026 · Reddit Post