CVE-2026-25762 in adonisjs
Summary
by MITRE • 02/07/2026
AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/17/2026
The vulnerability identified as CVE-2026-25762 affects AdonisJS, a popular TypeScript-first web framework that has gained significant traction in enterprise application development. This issue resides within the @adonisjs/bodyparser package, which serves as the core middleware for handling HTTP request bodies including file uploads. The problem manifests specifically in the multipart file handling logic where the framework processes incoming file data from HTTP requests. The vulnerability has been present in versions prior to 10.1.3 and 11.0.0-next.9, representing a critical security gap that could be exploited by malicious actors to disrupt service availability. The impact extends across various deployment scenarios where AdonisJS applications handle file uploads, particularly in environments where resource constraints are already tight.
The technical flaw stems from inadequate memory management within the multipart parser's file type detection mechanism. When processing file uploads, the system accumulates data in memory without proper bounds checking or resource limits during the file type identification process. This unbounded data accumulation occurs as the parser attempts to analyze file signatures and headers to determine appropriate handling methods. The parser does not implement proper memory consumption limits or streaming mechanisms to handle large files efficiently, leading to potential memory exhaustion. This behavior creates a direct path for attackers to craft malicious file upload requests that trigger excessive memory allocation, ultimately causing the application process to terminate or become unresponsive. The vulnerability aligns with CWE-400, which specifically addresses unchecked resource consumption, and represents a classic denial of service scenario where system resources are consumed inappropriately.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise entire application availability and user experience. In production environments, an attacker could exploit this weakness by uploading specially crafted files that cause the application server to consume all available memory resources, resulting in process crashes and complete service unavailability. This type of attack could be particularly damaging in cloud-hosted applications or microservices architectures where multiple instances might be affected simultaneously. The vulnerability affects any AdonisJS application that processes multipart file uploads, making it a widespread concern across the framework's user base. Organizations relying on AdonisJS for critical business applications face potential revenue loss, service degradation, and reputational damage if this vulnerability remains unpatched, particularly in high-traffic scenarios where file uploads are common.
Organizations should prioritize immediate patching of affected AdonisJS installations to mitigate this vulnerability, ensuring all systems are updated to versions 10.1.3 or 11.0.0-next.9. Beyond patch management, security teams should implement additional monitoring and rate-limiting mechanisms to detect and prevent abnormal file upload patterns that might indicate exploitation attempts. Network-level controls and application firewalls should be configured to limit file upload sizes and implement proper resource allocation policies. The ATT&CK framework categorizes this vulnerability under T1499.004, which covers network denial of service attacks, and T1566.001, which addresses phishing with malicious attachments. Security monitoring should include memory usage tracking and anomaly detection for file upload processes, while incident response procedures should be updated to address potential DoS scenarios involving resource exhaustion. Regular security assessments and penetration testing should verify that patched systems maintain proper resource management and do not exhibit similar vulnerabilities in related components.