Prototype Pollution Bypass in AdonisJS bodyparser (CVE-2026-25754)

Incomplete Fix for CVE-2026-25754 Vulnerability Overview Vulnerability ID: CVE-2026-25754 Affected Package: Severity: High (8.8 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: Low - Availability: High Description: - The fix introduced in commit for GHSA-f5x2-v4dh-vp4c / CVE-2026-25754 is incomplete and can be bypassed via nested prototype pollution payloads. - The original patch replaced the internal storage object with , which prevented direct payloads such as . However, payloads containing non-dangerous segments before or , such as , still result in pollution. - This issue can be exploited remotely by a single unauthenticated request using default configuration. Affected Versions Affected Versions: - - Impact: - An unauthenticated attacker can remotely pollute on any route accepting requests after the . - Since the pollution is process-wide, impacts may include authorization bypass, unexpected behavior in downstream libraries, or remote code execution via a prototype pollution gadget chain. Remediation Fixed Versions: - - Patches: - Fixes have been released for v6 and v7. - Users should upgrade to versions containing the following fixes: - https://github.com/adonisjs/bodyparser/releases/tag/v10.1.5 - https://github.com/adonisjs/bodyparser/releases/tag/v11.0.3 Details Regression Testing: - The regression tests added by the original patch only covered direct payloads, such as: - - Bypass Method: - These payloads are blocked because the root object no longer inherits from . - However, (via ) still creates intermediate objects using plain values. Once a normal segment is encountered, subsequent or segments regain access to . References CVE ID: CVE-2026-25754 Weakness: CWE-1321 Reporter: EchoSkaj

Goal Reached Thanks to every supporter — we hit 100%!

Prototype Pollution Bypass in AdonisJS bodyparser (CVE-2026-25754)

More from this source