Executive brief
AdonisJS is a popular Node.js web framework; its bodyparser component handles file uploads via the multipart protocol. A Denial of Service vulnerability allows attackers to crash the application by uploading specially crafted files that cause unbounded memory allocation, exhausting server RAM and terminating the application. No authentication is required if the upload endpoint is publicly accessible.
Technical details
The vulnerability exists in @adonisjs/bodyparser's multipart file handling logic (CWE-400, CWE-770). During file uploads, the PartHandler attempts to detect file types by accumulating data chunks in an internal memory buffer to perform magic number detection. This buffer lacks size limits, timeouts, or early termination conditions. When data does not match known file signatures, the buffer grows unbounded across the entire upload stream. An unauthenticated attacker can reach any publicly accessible multipart upload endpoint and send specially crafted requests with non-matching data streams, forcing the Node.js process to allocate memory until it runs out and crashes. Patches are available in @adonisjs/bodyparser v10.1.3 and v11.0.0-next.9.
Affected products
- AdonisJS bodyparser < 10.1.3, >= 11.0.0-next.0 and < 11.0.0-next.9
Timeline
- 2026-02-06: disclosed: Advisory GHSA-xx9g-fh25-4q64 published