Go to packages list

adonisjs-bodyparser

Ecosystem: npm

Downloads: 880.11 K

Vulnerabilities from the last (months)
  • 1CriticalAffects 2 versions
  • 3HighAffects 6 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
4vulnerabilities
  • Critical1 (25.0%)
  • High3 (75.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 2 vulnerabilities
    • Critical: 0
    • High: 2
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 1
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (4)

Known vulnerabilities affecting adonisjs-bodyparser, based on data from OSV.

Vulnerabilities affecting adonisjs-bodyparser
IDSeveritySummaryAffected versionsPublishedSource
GHSA-qcm7-3vpr-hj5hHigh@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754### Summary The fix for [GHSA-f5x2-vj4h-vg4c](https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c) / CVE-2026-25754 introduced in commit [`40e1c71`](https://github.com/adonisjs/bodyparser/commit/40e1c71f958cffb74f6b91bed6630dca979062ed) is incomplete and can be bypassed through nested prototype pollution payloads. The original patch replaced the internal `FormFields` storage object with `Object.create(null)`, preventing direct payloads such as `__proto__.polluted`. However, payloads containing a non-dangerous segment before `__proto__` or `constructor.prototype`, such as
  • >= 10.1.3, < 10.1.5
  • >= 11.0.0-next.9, < 11.0.3
GitHub (opens in a new tab)
GHSA-f5x2-vj4h-vg4cHighAdonisJS multipart body parsing has Prototype Pollution issue### Description A Prototype Pollution vulnerability (CWE-1321) in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts `@adonisjs/bodyparser` through version `10.1.2` and `11.x` prerelease versions prior to `11.0.0-next.8`. This issue has been patched in `@adonisjs/bodyparser` versions `10.1.3` and `11.0.0-next.9` ### Details AdonisJS parses `multipart/form-data` requests via the BodyParser package. During multipart parsing, form field names are used to construct plain JavaScript objects representing the parsed request bod
  • < 10.1.3
  • >= 11.0.0-next.0, < 11.0.0-next.9
GitHub (opens in a new tab)
GHSA-xx9g-fh25-4q64HighAdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection### Summary A Denial of Service (DoS) vulnerability (CWE-400) exists in the multipart file handling logic of `@adonisjs/bodyparser`. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue affects applications that accept `multipart/form-data` uploads using affected versions of `@adonisjs/bodyparser`. ### Details AdonisJS parses `multipart/form-data` requests using the BodyParser package. During file uploads, the mult
  • < 10.1.3
  • >= 11.0.0-next.0, < 11.0.0-next.9
GitHub (opens in a new tab)
GHSA-gvq6-hvvp-h34hCriticalAdonisJS Path Traversal in Multipart File Handling### Summary **Description** A Path Traversal (CWE-22) vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6. ### Details AdonisJS parses `multipart/form-data` via `BodyParser` and exposes uploads as `MultipartFile`. The issue is in the `MultipartFile.move(location, options)` default options. If `options
  • < 10.1.2
  • >= 11.0.0-next.0, < 11.0.0-next.6
GitHub (opens in a new tab)
  • GHSA-qcm7-3vpr-hj5hHigh
    @adonisjs/bodyparser has an incomplete fix for CVE-2026-25754
    • >= 10.1.3, < 10.1.5
    • >= 11.0.0-next.9, < 11.0.3
    GitHub (opens in a new tab)

    ### Summary The fix for [GHSA-f5x2-vj4h-vg4c](https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c) / CVE-2026-25754 introduced in commit [`40e1c71`](https://github.com/adonisjs/bodyparser/commit/40e1c71f958cffb74f6b91bed6630dca979062ed) is incomplete and can be bypassed through nested prototype pollution payloads. The original patch replaced the internal `FormFields` storage object with `Object.create(null)`, preventing direct payloads such as `__proto__.polluted`. However, payloads containing a non-dangerous segment before `__proto__` or `constructor.prototype`, such as

    CVE: CVE-2026-48795

  • GHSA-f5x2-vj4h-vg4cHigh
    AdonisJS multipart body parsing has Prototype Pollution issue
    • < 10.1.3
    • >= 11.0.0-next.0, < 11.0.0-next.9
    GitHub (opens in a new tab)

    ### Description A Prototype Pollution vulnerability (CWE-1321) in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts `@adonisjs/bodyparser` through version `10.1.2` and `11.x` prerelease versions prior to `11.0.0-next.8`. This issue has been patched in `@adonisjs/bodyparser` versions `10.1.3` and `11.0.0-next.9` ### Details AdonisJS parses `multipart/form-data` requests via the BodyParser package. During multipart parsing, form field names are used to construct plain JavaScript objects representing the parsed request bod

    CVE: CVE-2026-25754

  • GHSA-xx9g-fh25-4q64High
    AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection
    • < 10.1.3
    • >= 11.0.0-next.0, < 11.0.0-next.9
    GitHub (opens in a new tab)

    ### Summary A Denial of Service (DoS) vulnerability (CWE-400) exists in the multipart file handling logic of `@adonisjs/bodyparser`. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue affects applications that accept `multipart/form-data` uploads using affected versions of `@adonisjs/bodyparser`. ### Details AdonisJS parses `multipart/form-data` requests using the BodyParser package. During file uploads, the mult

    CVE: CVE-2026-25762

  • GHSA-gvq6-hvvp-h34hCritical
    AdonisJS Path Traversal in Multipart File Handling
    • < 10.1.2
    • >= 11.0.0-next.0, < 11.0.0-next.6
    GitHub (opens in a new tab)

    ### Summary **Description** A Path Traversal (CWE-22) vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6. ### Details AdonisJS parses `multipart/form-data` via `BodyParser` and exposes uploads as `MultipartFile`. The issue is in the `MultipartFile.move(location, options)` default options. If `options

    CVE: CVE-2026-21440

Showing 1-4 of 4 vulnerabilities