CVE-2026-25762

Katalog CVE

CVSS 7.5 · High EPSS 0,72%

Kerentanan Uncontrolled Resource Consumption pada adonisjs bodyparser. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

Rincian

Terbit di NVD

6 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64 advisory pihak ketiga
• https://github.com/adonisjs/bodyparser/releases/tag/v10.1.3 release notes
• https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9 release notes