CVE-2026-25754: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25754 is a Prototype Pollution vulnerability (CWE-1321) in the AdonisJS @adonisjs/bodyparser npm package affecting multipart form-data parsing. It allows unauthenticated remote attackers to manipulate JavaScript object prototypes at runtime by submitting specially crafted multipart field names. Affected versions include @adonisjs/bodyparser through 10.1.2 and 11.x prerelease versions prior to 11.0.0-next.9. The vulnerability was published on February 6, 2026, and carries a CVSS v3.1 base score of 7.2 (High) (Github Advisory, AdonisJS Advisory).

The root cause (CWE-1321) lies in the FormFields class within src/form_fields.ts, where the internal storage object was initialized as a plain {} literal rather than Object.create(null), leaving it with an inherited prototype chain. During multipart/form-data parsing, field names are used directly to construct JavaScript objects without validating for reserved property names such as __proto__, constructor, or prototype. An unauthenticated attacker can send a crafted HTTP multipart request with field names like __proto__.polluted=yes or constructor.prototype.polluted=yes, causing those properties to be assigned to Object.prototype and thereby affecting all objects in the Node.js process. The vulnerability is scoped exclusively to multipart body parsing and does not affect JSON or URL-encoded body parsing (Github Advisory, Patch Commit).

Successful exploitation can lead to unexpected application behavior, logic bypasses, and potential security control circumvention across the entire Node.js process, since polluted prototypes affect all objects inheriting from Object.prototype. The CVSS scope is marked as "Changed," reflecting that the impact extends beyond the vulnerable component to other parts of the application consuming the parsed request data. Confidentiality and integrity are both assessed as low impact, with no direct availability impact; however, the actual severity depends heavily on how the application uses the parsed multipart data downstream (AdonisJS Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-25754 as of the available data. The EPSS score is approximately 0.036% (0.019% per GitHub Advisory), placing it in a low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only that the target application expose an endpoint accepting multipart/form-data requests, with no authentication or special privileges needed (Github Advisory).

1. Reconnaissance: Identify AdonisJS applications running @adonisjs/bodyparser versions ≤10.1.2 or 11.0.0-next.0 through 11.0.0-next.8 that expose endpoints accepting multipart/form-data requests (e.g., file upload or form submission endpoints).
2. Craft malicious multipart request: Construct an HTTP POST request with Content-Type: multipart/form-data containing a field name designed to pollute the prototype, such as __proto__[polluted] or constructor[prototype][polluted], with an attacker-controlled value.
3. Submit the request: Send the crafted request to the target endpoint. The vulnerable FormFields parser assigns the field value to the inherited prototype chain of the internal storage object.
4. Trigger downstream impact: Subsequent code in the application that creates plain objects and checks for inherited properties (e.g., if (obj.polluted)) will now observe the attacker-injected value, potentially bypassing security checks, altering application logic, or causing unexpected behavior depending on the application's use of parsed data (Github Advisory, Patch Commit).

• Network: Inbound HTTP POST requests to multipart-accepting endpoints containing field names with __proto__, constructor, or prototype substrings in the body (e.g., Content-Disposition: form-data; name="__proto__[polluted]").
• Logs: Application or web server access logs showing POST requests to file upload or form submission routes with unusually structured or encoded field names; Node.js process logs showing unexpected property values on plain objects.
• Application Behavior: Unexpected truthy evaluations of properties on plain objects that should not exist; logic bypasses in authorization or validation routines that rely on object property checks.

Users should upgrade @adonisjs/bodyparser to version 10.1.3 (for v6/stable users) or 11.0.0-next.9 (for v7/prerelease users), which fix the issue by initializing the internal field storage with Object.create(null) instead of {}, eliminating the prototype chain. No configuration-based workaround is available; upgrading is the only recommended remediation. Applications that cannot immediately upgrade should consider adding server-side middleware to reject multipart requests containing field names with __proto__, constructor, or prototype substrings (Github Advisory, v11 Release, Patch Commit).

The advisory was published by AdonisJS maintainer RomainLanz on February 6, 2026, and reviewed the same day. No significant broader media coverage or notable external researcher commentary has been identified beyond the official GitHub advisory and standard vulnerability database aggregation.