Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @adonisjs/bodyparser | npm | >= 10.1.3, <= 10.1.4 | 10.1.5 |
| @adonisjs/bodyparser | npm | >= 11.0.0-next.9, <= 11.0.1 | 11.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability is a bypass of a previous prototype pollution fix in @adonisjs/bodyparser. The original fix was incomplete because it only prevented direct pollution of the prototype (e.g., __proto__.polluted) but not nested pollution (e.g., user.__proto__.polluted). The FormFields.add method processes incoming form fields. The vulnerability lies in this method, where it uses lodash.set to place data into a nested object structure based on the field name (the 'key'). Before the patch, there was no check to see if the key contained malicious segments like __proto__. This allowed an attacker to craft a field name that would cause lodash.set to traverse up to Object.prototype and modify it. The patch, introduced in commits 8a85eb0 and aa96908, adds a check at the beginning of the FormFields.add method. It splits the key into segments and iterates over them, ensuring none of them are __proto__, prototype, or constructor. If a malicious segment is found, the function returns early, preventing the call to lodash.set and thus preventing the prototype pollution. Therefore, the FormFields.add function is the specific location of the vulnerability.
FormFields.addsrc/form_fields.ts