Adonisjs
Monthly
Memory exhaustion in AdonisJS @adonisjs/bodyparser prior to versions 10.1.3 and 11.0.0-next.9 allows unauthenticated remote attackers to trigger denial of service by uploading files that cause unbounded memory accumulation during multipart parsing. The vulnerable multipart handler fails to enforce memory limits while processing file type detection, enabling attackers to exhaust server resources and crash the application. No patch is currently available for affected installations.
AdonisJS is a TypeScript-first web framework. versions up to 10.1.3 is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 7.2).
Reflected XSS in AdonisJS HTTP Server (versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2) enables remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious 404 URL containing an embedded HTML payload. The framework's default exception handler interpolates the unescaped request path directly into the HTML error response when debug mode is disabled and no custom error handler is configured. No public exploit has been identified at time of analysis, but the fix commit includes a working proof-of-concept test demonstrating a cookie-exfiltration attack using `fetch('/dashboard',{credentials:'include'})`, confirming practical exploitability.
This affects the package edge.js before 5.3.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Memory exhaustion in AdonisJS @adonisjs/bodyparser prior to versions 10.1.3 and 11.0.0-next.9 allows unauthenticated remote attackers to trigger denial of service by uploading files that cause unbounded memory accumulation during multipart parsing. The vulnerable multipart handler fails to enforce memory limits while processing file type detection, enabling attackers to exhaust server resources and crash the application. No patch is currently available for affected installations.
AdonisJS is a TypeScript-first web framework. versions up to 10.1.3 is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 7.2).
Reflected XSS in AdonisJS HTTP Server (versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2) enables remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious 404 URL containing an embedded HTML payload. The framework's default exception handler interpolates the unescaped request path directly into the HTML error response when debug mode is disabled and no custom error handler is configured. No public exploit has been identified at time of analysis, but the fix commit includes a working proof-of-concept test demonstrating a cookie-exfiltration attack using `fetch('/dashboard',{credentials:'include'})`, confirming practical exploitability.
This affects the package edge.js before 5.3.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.