What is the CVSS score of CVE-2026-25762?

CVE-2026-25762 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Bodyparser are affected by CVE-2026-25762?

AdonisJS applications are vulnerable to denial of service attacks through malicious file uploads that consume excessive server memory, potentially causing service outages.. A patch is available.

How to fix or mitigate CVE-2026-25762?

Within 24 hours: Identify all systems running affected AdonisJS versions (prior to 10.1.3 or 11.0.0-next.9) and disable file upload functionality if possible. Within 7 days: Implement compensating controls such as WAF rules to limit upload sizes and request rates, apply network segmentation to isolate affected services, and monitor memory consumption on affected servers. Within 30 days: Upgrade to patched versions (10.1.3 or 11.0.0-next.9) as soon as they become available and conduct full regression testing before production deployment.

Bodyparser CVE-2026-25762

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-02-06 security-advisories@github.com

GHSA-xx9g-fh25-4q64

Denial Of Service Bodyparser

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 06, 2026 - 23:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

AnalysisAI

Memory exhaustion in AdonisJS @adonisjs/bodyparser prior to versions 10.1.3 and 11.0.0-next.9 allows unauthenticated remote attackers to trigger denial of service by uploading files that cause unbounded memory accumulation during multipart parsing. The vulnerable multipart handler fails to enforce memory limits while processing file type detection, enabling attackers to exhaust server resources and crash the application. No patch is currently available for affected installations.

Technical ContextAI

This vulnerability (CWE-400: Uncontrolled Resource Consumption) affects AdonisJS is a TypeScript-first web framework.. AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

RemediationAI

Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.