# CVE-2026-25762: AdonisJS bodyparser denial of service via unbounded memory buffering

Source: https://junglewise.ai/threats/cve-2026-25762-adonisjs-bodyparser-denial-of-service-via-unbounded-memory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25762 · Severity: low · CVSS 3.1 · Published 2026-02-06

AdonisJS is a popular Node.js web framework; its bodyparser component handles file uploads via the multipart protocol. A Denial of Service vulnerability allows attackers to crash the application by uploading specially crafted files that cause unbounded memory allocation, exhausting server RAM and terminating the application. No authentication is required if the upload endpoint is publicly accessible.

Technologies: [AdonisJS Bodyparser](https://junglewise.ai/threats/technologies/bodyparser). Vendors: [AdonisJS](https://junglewise.ai/threats/vendors/adonisjs).

## Quick answers

**Is CVE-2026-25762 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25762 being exploited in the wild.

**How severe is CVE-2026-25762?** Low severity, with a CVSS score of 3.1, published 6 February 2026.

**Which products and versions are affected?** AdonisJS Bodyparser < 10.1.3, >= 11.0.0-next.0 and < 11.0.0-next.9.

**Is there a fix for CVE-2026-25762?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-25762 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25762?** Check whether you run AdonisJS Bodyparser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in @adonisjs/bodyparser's multipart file handling logic (CWE-400, CWE-770). During file uploads, the PartHandler attempts to detect file types by accumulating data chunks in an internal memory buffer to perform magic number detection. This buffer lacks size limits, timeouts, or early termination conditions. When data does not match known file signatures, the buffer grows unbounded across the entire upload stream. An unauthenticated attacker can reach any publicly accessible multipart upload endpoint and send specially crafted requests with non-matching data streams, forcing the Node.js process to allocate memory until it runs out and crashes. Patches are available in @adonisjs/bodyparser v10.1.3 and v11.0.0-next.9.

## Affected products

- AdonisJS bodyparser < 10.1.3, >= 11.0.0-next.0 and < 11.0.0-next.9

## Identifiers

- CVE-2026-25762
- GHSA-xx9g-fh25-4q64

## Timeline

- 2026-02-06: disclosed: Advisory GHSA-xx9g-fh25-4q64 published

## References

- [https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64](https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64)

## Related threats

- [AdonisJS bodyparser prototype pollution via nested multipart fields](https://junglewise.ai/threats/cve-2026-48795-adonisjs-bodyparser-prototype-pollution-via-nested-multipart)
- [AdonisJS BodyParser prototype pollution in multipart parsing](https://junglewise.ai/threats/cve-2026-25754-adonisjs-bodyparser-prototype-pollution-in-multipart-parsing)
- [AdonisJS BodyParser path traversal in file uploads](https://junglewise.ai/threats/cve-2026-21440-adonisjs-bodyparser-path-traversal-in-file-uploads)