CVE-2026-25754
Published: 06 February 2026
Summary
CVE-2026-25754 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Adonisjs Bodyparser. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25754 is a prototype pollution vulnerability (CWE-1321) in the multipart form-data parsing component of AdonisJS, a TypeScript-first web framework for Node.js. It affects versions prior to 10.1.3 and 11.0.0-next.9, where malformed multipart payloads can pollute object prototypes at runtime. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and scope change.
A remote, unauthenticated attacker can exploit this vulnerability by submitting specially crafted multipart form-data requests to an affected AdonisJS application. Successful exploitation allows manipulation of JavaScript object prototypes, potentially leading to denial of service, arbitrary code execution, or other impacts depending on the application's logic and gadget chains, with low confidentiality and integrity impacts but no availability disruption as per the CVSS vector.
The issue has been patched in AdonisJS versions 10.1.3 and 11.0.0-next.9, as detailed in the project's security advisory (GHSA-f5x2-vj4h-vg4c) and the fixing commit in the bodyparser repository (40e1c71f958cffb74f6b91bed6630dca979062ed). Security practitioners should upgrade to these versions and review applications for prototype pollution sinks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6931
Vulnerability details
AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3…
more
and 11.0.0-next.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing AdonisJS web app via crafted multipart input (T1190); prototype pollution enables potential arbitrary code execution in Node.js runtime (T1059.007) depending on gadget chains.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation and sanitization of untrusted multipart form-data inputs that are the root cause of the prototype pollution.
Requires timely application of the vendor patch (10.1.3 / 11.0.0-next.9) that eliminates the prototype-pollution flaw in the bodyparser component.
Enables integrity verification of the AdonisJS runtime and dependencies to detect unauthorized or vulnerable versions susceptible to the CVE.