7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25754

CVE-2026-25754: AdonisJS multipart body parsing has Prototype Pollution issue

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25754

CVE-2026-25754:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@adonisjs/bodyparser	npm	<= 10.1.2	10.1.3
@adonisjs/bodyparser	npm	>= 11.0.0-next.0, <= 11.0.0-next.8	11.0.0-next.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a prototype pollution issue within the @adonisjs/bodyparser package, specifically in how it handles multipart form data. The analysis of the provided patch commit reveals that the FormFields class is at the core of the vulnerability. The patch modifies the FormFields class in src/form_fields.ts to initialize its internal field storage using Object.create(null) instead of a plain object literal {}. This change is a standard mitigation for prototype pollution, as it creates an object that does not have a prototype, thus preventing any attempts to pollute Object.prototype. The new test files confirm that the add method of the FormFields class was the vector for this attack, as it would take a malicious field name from a multipart request and use it to modify the prototype of the internal fields object. Therefore, any runtime profile during exploitation would show the FormFields.add function as the key indicator of the vulnerable code path being executed.

Vulnerable functions

FormFields.add

src/form_fields.ts

The `FormFields` class was vulnerable to prototype pollution because its internal `#fields` property was initialized as a plain JavaScript object (`{}`). The `add` method, when processing multipart form fields, would use user-provided field names to set properties on this object. A malicious field name like `__proto__.polluted` could be used to add or modify properties on `Object.prototype`, affecting all objects in the application. The `add` method is therefore the function that directly processes the malicious input and causes the prototype pollution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.