CVE-2026-25762: AdonisJS Bodyparser DoS Vulnerability

CVE-2026-25762 Overview

A denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser, a component of the AdonisJS TypeScript-first web framework. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This vulnerability allows remote attackers to cause service disruption without requiring authentication.

Critical Impact

Remote attackers can exhaust server memory by sending specially crafted multipart file uploads, causing application crashes and denial of service conditions that affect all users of the targeted AdonisJS application.

Affected Products

• @adonisjs/bodyparser versions prior to 10.1.3
• @adonisjs/bodyparser versions prior to 11.0.0-next.9
• AdonisJS applications using vulnerable bodyparser versions

Discovery Timeline

• February 6, 2026 - CVE-2026-25762 published to NVD
• February 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25762

Vulnerability Analysis

This vulnerability falls under CWE-400 (Uncontrolled Resource Consumption) and affects the multipart file handling functionality in AdonisJS bodyparser. The core issue lies in how the parser handles file type detection during multipart form data processing. When files are uploaded, the parser reads data into memory buffers to perform file type detection (magic byte analysis). However, the implementation lacks proper bounds checking on the amount of data accumulated during this detection phase.

An attacker can exploit this by sending multipart requests with malformed or excessively large file segments. The parser continues to buffer incoming data without enforcing memory limits, leading to unbounded memory growth. In high-traffic scenarios or with sustained attack traffic, this can quickly exhaust available system memory, causing the Node.js process to crash or be terminated by the operating system's out-of-memory killer.

Root Cause

The root cause is improper resource consumption controls in the multipart parser's file type detection routine. The parser lacks adequate memory bounds checking when buffering file content for type detection, allowing attackers to force unbounded memory allocation through malicious file upload requests.

Attack Vector

The vulnerability is exploitable over the network without any authentication or user interaction. An attacker sends specially crafted multipart HTTP requests to any endpoint that accepts file uploads. The attack can be amplified by sending multiple concurrent requests, rapidly exhausting server resources. The attack targets the availability of the application, with no impact on confidentiality or integrity of data.

The exploitation mechanism involves sending multipart form data where file segments are designed to maximize memory consumption during the type detection phase. Since no authentication is required and the attack can be performed remotely, any publicly accessible AdonisJS application with file upload functionality is potentially vulnerable.

Detection Methods for CVE-2026-25762

Indicators of Compromise

• Abnormal memory consumption spikes correlated with file upload activity
• Node.js process crashes with out-of-memory errors
• Increased frequency of multipart POST requests from single or few IP addresses
• Application unresponsiveness or slow response times during file upload operations

Detection Strategies

• Monitor Node.js process memory usage and alert on unusual growth patterns
• Implement rate limiting on file upload endpoints to detect and throttle abuse
• Analyze HTTP logs for patterns of large or malformed multipart requests
• Deploy application performance monitoring (APM) to track resource usage during file processing

Monitoring Recommendations

• Set up memory threshold alerts for Node.js processes handling file uploads
• Monitor request patterns to file upload endpoints for anomalous behavior
• Track HTTP 413 (Payload Too Large) and 5xx error rates that may indicate attack attempts
• Review system logs for OOM killer activity targeting Node.js processes

How to Mitigate CVE-2026-25762

Immediate Actions Required

• Update @adonisjs/bodyparser to version 10.1.3 or later for the stable branch
• Update to version 11.0.0-next.9 or later if using the next/preview branch
• Audit all AdonisJS applications for vulnerable bodyparser versions
• Implement rate limiting on file upload endpoints as a defense-in-depth measure

Patch Information

The AdonisJS team has released patched versions that address this vulnerability. Users should update to:

• Stable branch: v10.1.3
• Next branch: v11.0.0-next.9

For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-xx9g-fh25-4q64.

Workarounds

• Implement upstream load balancer or reverse proxy limits on request body sizes
• Configure web application firewall (WAF) rules to limit multipart request sizes
• Deploy rate limiting at the infrastructure level for file upload endpoints
• Consider temporarily disabling file upload functionality if patching is not immediately possible

# Update @adonisjs/bodyparser to patched version
npm update @adonisjs/bodyparser

# Or install specific patched version
npm install @adonisjs/bodyparser@10.1.3

# Verify installed version
npm list @adonisjs/bodyparser