# CVE-2026-25754: AdonisJS BodyParser prototype pollution in multipart parsing

Source: https://junglewise.ai/threats/cve-2026-25754-adonisjs-bodyparser-prototype-pollution-in-multipart-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25754 · Severity: low · CVSS 3.1 · Published 2026-02-06

AdonisJS BodyParser is a Node.js library that processes file uploads and form data in web applications. A flaw in how it parses multipart form data allows an attacker to inject malicious field names that corrupt the application's internal object structures, potentially bypassing security checks or causing unexpected behavior depending on how the application uses the parsed data.

Technologies: [AdonisJS Bodyparser](https://junglewise.ai/threats/technologies/bodyparser). Vendors: [AdonisJS](https://junglewise.ai/threats/vendors/adonisjs).

## Quick answers

**Is CVE-2026-25754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25754 being exploited in the wild.

**How severe is CVE-2026-25754?** Low severity, with a CVSS score of 3.1, published 6 February 2026.

**Which products and versions are affected?** AdonisJS Bodyparser <=10.1.2, >=11.0.0-next.0 and <=11.0.0-next.8.

**Is there a fix for CVE-2026-25754?** A patch was published on 2026-02-06: Patched in versions 10.1.3 and 11.0.0-next.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25754 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25754?** Check whether you run AdonisJS Bodyparser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Prototype Pollution vulnerability (CWE-1321) exists in AdonisJS BodyParser's multipart/form-data parsing code. During parsing, form field names are directly used to construct JavaScript objects without sufficient validation, allowing specially crafted field names (e.g., __proto__, constructor, prototype) to pollute object prototypes at runtime. The vulnerability requires an application endpoint that accepts multipart/form-data requests; JSON and URL-encoded parsing are unaffected. Exploitation can lead to unexpected application behavior and logic bypasses depending on how the application consumes the parsed objects. Patches have been released in versions 10.1.3 and 11.0.0-next.9.

## Affected products

- AdonisJS BodyParser <=10.1.2, >=11.0.0-next.0 and <=11.0.0-next.8

## Identifiers

- CVE-2026-25754
- GHSA-f5x2-vj4h-vg4c

## Timeline

- 2026-02-06: disclosed
- 2026-02-06: patched: Patched in versions 10.1.3 and 11.0.0-next.9

## References

- [https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c](https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c)

## Related threats

- [AdonisJS bodyparser prototype pollution via nested multipart fields](https://junglewise.ai/threats/cve-2026-48795-adonisjs-bodyparser-prototype-pollution-via-nested-multipart)
- [AdonisJS bodyparser denial of service via unbounded memory buffering](https://junglewise.ai/threats/cve-2026-25762-adonisjs-bodyparser-denial-of-service-via-unbounded-memory)
- [AdonisJS BodyParser path traversal in file uploads](https://junglewise.ai/threats/cve-2026-21440-adonisjs-bodyparser-path-traversal-in-file-uploads)