Quick answers
- Is CVE-2026-25762 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-25762 being exploited in the wild.
- How severe is CVE-2026-25762?
- Low severity, with a CVSS score of 3.1, published 6 February 2026.
- Which products and versions are affected?
- AdonisJS Bodyparser < 10.1.3, >= 11.0.0-next.0 and < 11.0.0-next.9.
- Is there a fix for CVE-2026-25762?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-25762 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-25762?
- Check whether you run AdonisJS Bodyparser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in @adonisjs/bodyparser's multipart file handling logic (CWE-400, CWE-770). During file uploads, the PartHandler attempts to detect file types by accumulating data chunks in an internal memory buffer to perform magic number detection. This buffer lacks size limits, timeouts, or early termination conditions. When data does not match known file signatures, the buffer grows unbounded across the entire upload stream. An unauthenticated attacker can reach any publicly accessible multipart upload endpoint and send specially crafted requests with non-matching data streams, forcing the Node.js process to allocate memory until it runs out and crashes. Patches are available in @adonisjs/bodyparser v10.1.3 and v11.0.0-next.9.
Affected products
- AdonisJS bodyparser < 10.1.3, >= 11.0.0-next.0 and < 11.0.0-next.9
Identifiers
- CVE-2026-25762
- GHSA-xx9g-fh25-4q64
Timeline
- 2026-02-06: disclosed: Advisory GHSA-xx9g-fh25-4q64 published