CVE-2026-25762: Denial of Service Vulnerability in @adonisjs/bodyparser Due to Unrestricted Memory Buffering
Summary
CVE-2026-25762: A Denial of Service (DoS) vulnerability (CWE-400) exists in the multipart file handling logic of @adonisjs/bodyparser. Affects @adonisjs/bodyparser across 2 version ranges.
< 10.1.3
>= 11.0.0-next.0, < 11.0.0-next.9
Fixed in 10.1.3 or 11.0.0-next.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @adonisjs/bodyparser package is a middleware for handling multipart/form-data requests in AdonisJS applications. It facilitates file uploads by parsing incoming data and detecting file types. However, it has a vulnerability that allows excessive memory consumption during file type detection, which can lead to Denial of Service (DoS) attacks.
Vulnerability Detail
A Denial of Service (DoS) vulnerability (CWE-400) exists in the multipart file handling logic of @adonisjs/bodyparser. The multipart parser accumulates data in memory without a maximum size limit while detecting file types. If an attacker sends a specially crafted multipart request with a large or unbounded data stream that does not match known file signatures, the internal buffer continues to grow, potentially exhausting available RAM and causing the Node.js process to terminate. This results in a Denial of Service, making the application unavailable to legitimate users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 10.1.310.1.3npm install @adonisjs/bodyparser@10.1.3 -
>= 11.0.0-next.0, < 11.0.0-next.911.0.0-next.9npm install @adonisjs/bodyparser@11.0.0-next.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement strict file size limits and validate file types before processing uploads. This can help mitigate the risk of excessive memory consumption. Additionally, consider using a timeout mechanism to terminate requests that exceed expected processing time.
Conclusion
The @adonisjs/bodyparser package has a critical Denial of Service vulnerability due to unrestricted memory buffering during file type detection. It is essential to upgrade to the patched versions to mitigate the risk and ensure the stability of your application.
See every vulnerability recorded for @adonisjs/bodyparser →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Versions <= 10.1.2 and <= 11.0.0-next.8 are affected by this vulnerability.
No, authentication is not required if the upload endpoint is publicly accessible.
The vulnerability can lead to Denial of Service, making the application unavailable to legitimate users due to excessive memory consumption.
References
Related vulnerabilities
Recent vulnerabilities recorded for @adonisjs/bodyparser.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.