Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The fix for GHSA-f5x2-vj4h-vg4c / CVE-2026-25754 introduced in commit 40e1c71 is incomplete and can be bypassed through nested prototype pollution payloads. The original patch replaced the internal FormFields storage object with Object.create(null), preventing direct payloads such as proto.polluted. However, payloads containing a non-dangerous segment before proto or constructor.prototype, such as user.proto.polluted, still lead to Object.prototype pollution. This issue is exploitable remotely through a single unauthenticated multipart/form-data request using the default configuration. Affected versions - = 10.1.3 < 10.1.5 - = 11.0.0-next.9 < 11.0.3 Details The regression tests added by the original fix only covered direct payloads such as: - proto.polluted - constructor.prototype.polluted These payloads are blocked because the root object no longer inherits from Object.prototype. However, lodash .set() (via @poppinss/utils) still creates intermediate objects using plain {}…
Recommended action: Upgrade to 11.0.3 or 10.1.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Denial of Service (DoS) vulnerability (CWE-400) exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue affects applications that accept multipart/form-data uploads using affected versions of @adonisjs/bodyparser. Details AdonisJS parses multipart/form-data requests using the BodyParser package. During file uploads, the multipart parser attempts to detect the uploaded file type by accumulating incoming chunks in an internal buffer to perform magic number detection. The internal buffer used for this detection does not enforce a maximum size and is not protected by a timeout or early termination condition. If the uploaded data does not match any supported file signatures, the buffer continues to grow as more chunks are received. When…
Recommended action: Upgrade to 11.0.0-next.9 (pre-release) or 10.1.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Prototype Pollution vulnerability (CWE-1321) in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts @adonisjs/bodyparser through version 10.1.2 and 11.x prerelease versions prior to 11.0.0-next.8. This issue has been patched in @adonisjs/bodyparser versions 10.1.3 and 11.0.0-next.9 Details AdonisJS parses multipart/form-data requests via the BodyParser package. During multipart parsing, form field names are used to construct plain JavaScript objects representing the parsed request body. Due to insufficient validation of multipart field names, specially crafted fields containing reserved property names such as proto, constructor, or prototype could be assigned directly to objects created during parsing. This allows an attacker to pollute object prototypes, potentially affecting other parts of the application that rely on these objects. The vulnerability is limited to multipart request parsing and does…
Recommended action: Upgrade to 11.0.0-next.9 (pre-release) or 10.1.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Description A Path Traversal (CWE-22) vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6. Details AdonisJS parses multipart/form-data via BodyParser and exposes uploads as MultipartFile. The issue is in the MultipartFile.move(location, options) default options. If options.name isn't provided, it defaults to the unsanitized client filename and builds the destination with path.join(location, name), allowing a traversal to escape the default or intended directory chosen by the developer. If options.overwrite isn't provided, it defaults to true, allowing file overwrites. The documentation previously demonstrated examples leading developers to this vulnerable code path. Impact Exploitation…
Recommended action: Upgrade to 11.0.0-next.6 (pre-release) or 10.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.