Quick answers
- Is CVE-2026-25754 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-25754 being exploited in the wild.
- How severe is CVE-2026-25754?
- Low severity, with a CVSS score of 3.1, published 6 February 2026.
- Which products and versions are affected?
- AdonisJS Bodyparser <=10.1.2, >=11.0.0-next.0 and <=11.0.0-next.8.
- Is there a fix for CVE-2026-25754?
- A patch was published on 2026-02-06: Patched in versions 10.1.3 and 11.0.0-next.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-25754 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-25754?
- Check whether you run AdonisJS Bodyparser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Prototype Pollution vulnerability (CWE-1321) exists in AdonisJS BodyParser's multipart/form-data parsing code. During parsing, form field names are directly used to construct JavaScript objects without sufficient validation, allowing specially crafted field names (e.g., __proto__, constructor, prototype) to pollute object prototypes at runtime. The vulnerability requires an application endpoint that accepts multipart/form-data requests; JSON and URL-encoded parsing are unaffected. Exploitation can lead to unexpected application behavior and logic bypasses depending on how the application consumes the parsed objects. Patches have been released in versions 10.1.3 and 11.0.0-next.9.
Affected products
- AdonisJS BodyParser <=10.1.2, >=11.0.0-next.0 and <=11.0.0-next.8
Identifiers
- CVE-2026-25754
- GHSA-f5x2-vj4h-vg4c
Timeline
- 2026-02-06: disclosed
- 2026-02-06: patched: Patched in versions 10.1.3 and 11.0.0-next.9