{"id":"GHSA-f5x2-vj4h-vg4c","summary":"AdonisJS multipart body parsing has Prototype Pollution issue","details":"### Description\n\nA Prototype Pollution vulnerability (CWE-1321) in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts `@adonisjs/bodyparser` through version `10.1.2` and `11.x` prerelease versions prior to `11.0.0-next.8`. This issue has been patched in `@adonisjs/bodyparser` versions `10.1.3` and `11.0.0-next.9`\n\n### Details\n\nAdonisJS parses `multipart/form-data` requests via the BodyParser package. During multipart parsing, form field names are used to construct plain JavaScript objects representing the parsed request body.\n\nDue to insufficient validation of multipart field names, specially crafted fields containing reserved property names such as `__proto__`, `constructor`, or `prototype` could be assigned directly to objects created during parsing. This allows an attacker to pollute object prototypes, potentially affecting other parts of the application that rely on these objects.\n\n**The vulnerability is limited to multipart request parsing and does not affect JSON or URL-encoded body parsing.**\n\n### Impact\n\nExploitation requires an application endpoint that accepts and parses `multipart/form-data` requests.\n\nIf exploited, prototype pollution may lead to unexpected application behavior, logic bypasses, or security issues depending on how polluted objects are later consumed. The severity of the impact depends on application logic and usage patterns of the parsed request data.\n\n### Patches\n\nFixes targeting v6 and v7 have been published below.\n\nUsers should upgrade to a version that includes the following fix:\n- https://github.com/adonisjs/bodyparser/releases/tag/v10.1.3\n- https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9","aliases":["CVE-2026-25754"],"modified":"2026-02-07T00:52:31.326313Z","published":"2026-02-06T19:27:30Z","database_specific":{"nvd_published_at":"2026-02-06T23:15:54Z","cwe_ids":["CWE-1321"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-02-06T19:27:30Z"},"references":[{"type":"WEB","url":"https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25754"},{"type":"WEB","url":"https://github.com/adonisjs/bodyparser/commit/40e1c71f958cffb74f6b91bed6630dca979062ed"},{"type":"WEB","url":"https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9"},{"type":"PACKAGE","url":"https://github.com/adonisjs/core"}],"affected":[{"package":{"name":"@adonisjs/bodyparser","ecosystem":"npm","purl":"pkg:npm/%40adonisjs/bodyparser"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"10.1.3"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 10.1.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-f5x2-vj4h-vg4c/GHSA-f5x2-vj4h-vg4c.json"}},{"package":{"name":"@adonisjs/bodyparser","ecosystem":"npm","purl":"pkg:npm/%40adonisjs/bodyparser"},"ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0-next.0"},{"fixed":"11.0.0-next.9"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 11.0.0-next.8","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-f5x2-vj4h-vg4c/GHSA-f5x2-vj4h-vg4c.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}]}