CVE-2026-25762: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25762 is a Denial of Service (DoS) vulnerability in the @adonisjs/bodyparser npm package, caused by unrestricted memory buffering in the multipart PartHandler during file type detection. It affects all versions up to and including 10.1.2, as well as pre-release versions 11.0.0-next.0 through 11.0.0-next.8. The vulnerability was disclosed on February 6, 2026, by researcher ZeroXJacks and published to the GitHub Advisory Database the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). During multipart/form-data file uploads, AdonisJS's bodyparser accumulates incoming data chunks into an internal buffer to perform magic number (file signature) detection; this buffer has no enforced maximum size, no timeout, and no early termination condition. If the uploaded data does not match any known file signature, the buffer grows unboundedly for the duration of the upload stream — a condition worsened by configurations using deferred validation or permissive file size limits. An unauthenticated attacker can exploit this by sending a crafted multipart request with a large or infinite stream of unrecognized data, causing the Node.js process to exhaust available RAM and terminate (GitHub Advisory, AdonisJS Security Advisory).

Successful exploitation results in complete availability loss for the affected Node.js application — the process terminates due to an out-of-memory condition, making the application unavailable to all legitimate users. There is no confidentiality or integrity impact; the vulnerability is purely a DoS. The risk is amplified for publicly accessible file upload endpoints that require no authentication, as any remote attacker can trigger the condition without credentials (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037% (11th percentile), indicating a low near-term probability of exploitation. However, the attack requires no authentication and low complexity, making it straightforward to exploit against any publicly reachable upload endpoint (GitHub Advisory, Feedly).

1. Reconnaissance: Identify AdonisJS applications running affected versions of @adonisjs/bodyparser (≤10.1.2 or 11.0.0-next.0 through next.8) that expose a publicly accessible multipart file upload endpoint.
2. Craft malicious payload: Prepare a multipart/form-data HTTP request body containing a file part filled with a large or continuous stream of arbitrary bytes that do not match any known file magic number signatures (e.g., random binary data or repeated non-signature bytes).
3. Send the request: Transmit the crafted multipart request to the target upload endpoint — no authentication token or session is required if the endpoint is public. Tools such as curl, python-requests, or custom scripts can be used to stream the payload.
4. Trigger unbounded buffering: The bodyparser's PartHandler accumulates all incoming chunks into its internal detection buffer without limit, as the data never matches a known file signature and no threshold terminates the process.
5. Achieve DoS: The Node.js process continuously allocates memory until available RAM is exhausted, causing the process to crash with an out-of-memory error and rendering the application unavailable (GitHub Advisory, AdonisJS Security Advisory).

• Network: Unusually large or long-duration HTTP POST requests to file upload endpoints with Content-Type: multipart/form-data; requests with abnormally large Content-Length values or chunked transfer encoding that streams indefinitely.
• Logs: Node.js process crash logs or unhandled exception logs referencing out-of-memory (OOM) errors (e.g., FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory); repeated upload requests from the same IP to the same endpoint in a short timeframe.
• Process: Rapid, sustained growth in Node.js process memory consumption visible via system monitoring tools (e.g., top, htop, or APM dashboards); unexpected process termination and restart of the AdonisJS application server.
• File System: No file artifacts are expected, as the attack is entirely in-memory and does not write to disk (GitHub Advisory).

Users should upgrade @adonisjs/bodyparser to the patched versions: 10.1.3 (for v6 users) or 11.0.0-next.9 (for v7/pre-release users). The fix introduces a threshold after which the parser falls back to filename-based file type detection instead of continuing to buffer data, ensuring predictable memory usage. As a temporary workaround prior to patching, operators can restrict file upload endpoint access (e.g., require authentication, apply rate limiting, or enforce strict Content-Length limits at the reverse proxy/WAF layer) to reduce exposure (v10.1.3 Release, v11.0.0-next.9 Release).

The vulnerability was published by AdonisJS maintainer RomainLanz and credited to researcher ZeroXJacks. Brief social media mentions appeared on Mastodon and Bluesky via The Hacker Wire shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (GitHub Advisory).