VYPR
Get started
← All advisories
High severityNVD Advisory· Published Feb 6, 2026· Updated Feb 9, 2026

AdonisJS multipart body parsing has Prototype Pollution issue

CVE-2026-25754

Description

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@adonisjs/bodyparsernpm
< 10.1.310.1.3
@adonisjs/bodyparsernpm
>= 11.0.0-next.0, < 11.0.0-next.911.0.0-next.9

Affected products

1

Patches

1
40e1c71f958c

fix: prevent prototype pollution via multipart field names

https://github.com/adonisjs/bodyparserRomain LanzFeb 5, 2026via ghsa
commit
2 files changed · +17 −1
  • src/form_fields.ts+1 −1 modified
    @@ -17,7 +17,7 @@ export class FormFields {
   /**
    * Internal storage for form fields
    */
-  #fields: any = {}
+  #fields: any = Object.create(null)
 
   #normalizer?: (value: string) => string | null
  • tests/form_fields.spec.ts+16 −0 modified
    @@ -94,4 +94,20 @@ test.group('Form Fields Parser', () => {
     formFields.add('username', '     ')
     assert.deepEqual(formFields.get(), { username: null })
   })
+
+  test('should not pollute Object.prototype via __proto__', ({ assert }) => {
+    const formFields = new FormFields()
+    formFields.add('__proto__.polluted', 'yes')
+
+    const clean: Record<string, any> = {}
+    assert.isUndefined(clean['polluted'])
+  })
+
+  test('should not pollute Object.prototype via constructor.prototype', ({ assert }) => {
+    const formFields = new FormFields()
+    formFields.add('constructor.prototype.polluted2', 'yes')
+
+    const clean: Record<string, any> = {}
+    assert.isUndefined(clean['polluted2'])
+  })
 })

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.