CVE-2026-25754
Published: 06 February 2026
Summary
CVE-2026-25754 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Adonisjs Bodyparser. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing AdonisJS web app via crafted multipart input (T1190); prototype pollution enables potential arbitrary code execution in Node.js runtime (T1059.007) depending on gadget chains.
NVD Description
AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3…
more
and 11.0.0-next.9.
Deeper analysisAI
CVE-2026-25754 is a prototype pollution vulnerability (CWE-1321) in the multipart form-data parsing component of AdonisJS, a TypeScript-first web framework for Node.js. It affects versions prior to 10.1.3 and 11.0.0-next.9, where malformed multipart payloads can pollute object prototypes at runtime. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and scope change.
A remote, unauthenticated attacker can exploit this vulnerability by submitting specially crafted multipart form-data requests to an affected AdonisJS application. Successful exploitation allows manipulation of JavaScript object prototypes, potentially leading to denial of service, arbitrary code execution, or other impacts depending on the application's logic and gadget chains, with low confidentiality and integrity impacts but no availability disruption as per the CVSS vector.
The issue has been patched in AdonisJS versions 10.1.3 and 11.0.0-next.9, as detailed in the project's security advisory (GHSA-f5x2-vj4h-vg4c) and the fixing commit in the bodyparser repository (40e1c71f958cffb74f6b91bed6630dca979062ed). Security practitioners should upgrade to these versions and review applications for prototype pollution sinks.
Details
- CWE(s)