CVE-2026-25754 Details
Description
AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.
A prototype pollution vulnerability has been identified in AdonisJS versions prior to 10.1.3 and 11.0.0-next.9. This vulnerability exists within the framework's multipart form-data parsing, allowing remote attackers to manipulate object prototypes at runtime. The issue arises from inadequate validation of multipart field names, which can be exploited by crafting fields that include reserved property names such as '__proto__', 'constructor', or 'prototype'. When these fields are processed, they can directly alter object prototypes, potentially disrupting application behavior or introducing security risks.
Users should upgrade to AdonisJS versions 10.1.3 or 11.0.0-next.9, both of which include the necessary patch. Instructions for upgrading can be found in the release notes on the AdonisJS bodyparser GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| adonisjs bodyparser | < 10.1.3 >= 10.1.4, < 11.0.0 11.0.0 next1 11.0.0 next2 11.0.0 next3 11.0.0 next4 11.0.0 next5 11.0.0 next6 11.0.0 next7 11.0.0 next8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Feb 6, 2026 | New CVE Received | [email protected] |