CVE-2026-25754
Adonisjs Bodyparser ≤ 10.1.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-25754 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Adonisjs Bodyparser. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25754 is a prototype pollution vulnerability (CWE-1321) in the multipart form-data parsing component of AdonisJS, a TypeScript-first web framework for Node.js. It affects versions prior to 10.1.3 and 11.0.0-next.9, where malformed multipart payloads can pollute object prototypes at runtime. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and scope change.
A remote, unauthenticated attacker can exploit this vulnerability by submitting specially crafted multipart form-data requests to an affected AdonisJS application. Successful exploitation allows manipulation of JavaScript object prototypes, potentially leading to denial of service, arbitrary code execution, or other impacts depending on the application's logic and gadget chains, with low confidentiality and integrity impacts but no availability disruption as per the CVSS vector.
The issue has been patched in AdonisJS versions 10.1.3 and 11.0.0-next.9, as detailed in the project's security advisory (GHSA-f5x2-vj4h-vg4c) and the fixing commit in the bodyparser repository (40e1c71f958cffb74f6b91bed6630dca979062ed). Security practitioners should upgrade to these versions and review applications for prototype pollution sinks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6931
Vulnerability Data
AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3…
more
and 11.0.0-next.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches prototype-pollution flaws before release.
Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.
Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.