NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
HIGH severity

CVE-2026-25762 — @adonisjs/bodyparser

HIGH

CVE-2026-25762 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in @adonisjs/bodyparser. A fix is available for @adonisjs/bodyparser — see the affected versions and patch details below.

AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection

Also known asGHSA-xx9g-fh25-4q64
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-25762.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk-0.01%
Lower risk than most CVEs45th percentile — riskier than 45% of all scored CVEsHighest risk
0.00%0.38%0.77%1.15%0.0%0.5%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

17other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@adonisjs/bodyparsernpm
272Kdownloads / week

Description

Summary

A Denial of Service (DoS) vulnerability (CWE-400) exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination.

This issue affects applications that accept multipart/form-data uploads using affected versions of @adonisjs/bodyparser.

Details

AdonisJS parses multipart/form-data requests using the BodyParser package. During file uploads, the multipart parser attempts to detect the uploaded file type by accumulating incoming chunks in an internal buffer to perform magic number detection.

The internal buffer used for this detection does not enforce a maximum size and is not protected by a timeout or early termination condition. If the uploaded data does not match any supported file signatures, the buffer continues to grow as more chunks are received.

When certain configurations are used, such as deferred validations or permissive file size limits, this buffering behavior may persist for the duration of the upload stream.

Impact

Exploitation requires a reachable endpoint that accepts multipart file uploads.

An attacker can send a specially crafted multipart request containing a large or unbounded stream of data that does not match known file signatures. This may cause the server to continuously allocate memory until the Node.js process exhausts available RAM and terminates due to an out-of-memory condition.

This results in a Denial of Service, making the application unavailable to legitimate users. Authentication is not required if the upload endpoint is publicly accessible.

Patches

Fixes targeting v6 and v7 have been published below.

Users should upgrade to a version that includes the following fix:

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npm@adonisjs/bodyparserall versions10.1.3npm install @adonisjs/bodyparser@10.1.3
📦npm@adonisjs/bodyparser≥ 11.0.0-next.0&&< 11.0.0-next.911.0.0-next.9npm install @adonisjs/bodyparser@11.0.0-next.9

Affected Products

1 product · 10 configurations
Application
bodyparseradonisjs
≥ 10.1.4 && < 11.0.0
1 version
11.0.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @adonisjs/bodyparser, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update @adonisjs/bodyparser to 10.1.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-25762 is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

### Summary A Denial of Service (DoS) vulnerability (CWE-400) exists in the multipart file handling logic of `@adonisjs/bodyparser`. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue affects applications that accept `multipart/form-data` uploads using affected versions of `@adonisjs/bodyparser`. ### Details AdonisJS parses `multipart/form-data` requests using the BodyParser package. During file uploads, the mult
O3 Security · Impact-Aware SCA

Is CVE-2026-25762 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-25762: @adonisjs/bodyparser — Fixed in 10.1.3