Executive brief
AdonisJS BodyParser is a Node.js library that processes file uploads and form data in web applications. A flaw in how it parses multipart form data allows an attacker to inject malicious field names that corrupt the application's internal object structures, potentially bypassing security checks or causing unexpected behavior depending on how the application uses the parsed data.
Technical details
A Prototype Pollution vulnerability (CWE-1321) exists in AdonisJS BodyParser's multipart/form-data parsing code. During parsing, form field names are directly used to construct JavaScript objects without sufficient validation, allowing specially crafted field names (e.g., __proto__, constructor, prototype) to pollute object prototypes at runtime. The vulnerability requires an application endpoint that accepts multipart/form-data requests; JSON and URL-encoded parsing are unaffected. Exploitation can lead to unexpected application behavior and logic bypasses depending on how the application consumes the parsed objects. Patches have been released in versions 10.1.3 and 11.0.0-next.9.
Affected products
- AdonisJS BodyParser <=10.1.2, >=11.0.0-next.0 and <=11.0.0-next.8
Timeline
- 2026-02-06: disclosed
- 2026-02-06: patched: Patched in versions 10.1.3 and 11.0.0-next.9