CVE-2026-25754

CVE-2026-25754 affects AdonisJS multipart form-data parsing (package: @adonisjs/bodyparser). The underlying issue is prototype pollution caused by insufficient validation of multipart field names during parsing, allowing manipulation of object prototypes at runtime. Affected versions are AdonisJS...

CVE-2026-25762

CVE-2026-25762 affects AdonisJS, specifically the @adonisjs/bodyparser multipart file handling logic. The vulnerability arises when the multipart parser processes file uploads, potentially accumulating an unbounded amount of data in memory while attempting to detect file types, leading to excessi...