https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 22:24:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267659 EUVD-2026-267659 https://cve.radiocsirt.org/vuln/euvd-2026-267659 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25754 <p>AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.</p> <p>AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25754 https://cve.radiocsirt.org/vuln/ghsa-f5x2-vj4h-vg4c <p><strong>Affected:</strong> npm: @adonisjs/bodyparser</p> <p>### Description</p> <p>A Prototype Pollution vulnerability (CWE-1321) in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts `@adonisjs/bodyparser` through version `10.1.2` and `11.x` prerelease versions prior to `11.0.0-next.8`. This issue has been patched in `@adonisjs/bodyparser` versions `10.1.3` and `11.0.0-next.9`</p> <p>### Details</p> <p>AdonisJS parses `multipart/form-data` requests via the BodyParser package. During multipart parsing, form field names are used to construct plain JavaScript objects representing the parsed request body.</p> <p>Due to insufficient validation of multipart field names, specially crafted fields containing reserved property names such as `__proto__`, `constructor`, or `prototype` could be assigned directly to objects created during parsing. This allows an attacker to pollute object prototypes, potentially affecting other parts of the application that rely on these objects.</p> <p>**The vulnerability is limited to multipart request parsing and does not affect JSON or URL-encoded body parsing.**</p> <p>### Impact</p> <p>Exploitation requires an application endpoint that accepts and parses `multipart/form-data` requests.</p> <p>If exploited, prototype pollution may lead to unexpected application behavior, logic bypasses, or security issues depending on how polluted objects are later consumed. The severity of the impact depends on application logic and usage patterns of the parsed request data.</p> <p>### Patches</p> <p>Fixes target…</p> <p><strong>Affected:</strong> npm: @adonisjs/bodyparser</p> <p>### Description</p> <p>A Prototype Pollution vulnerability (CWE-1321) in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts `@adonisjs/bodyparser` through version `10.1.2` and `11.x` prerelease versions prior to `11.0.0-next.8`. This issue has been patched in `@adonisjs/bodyparser` versions `10.1.3` and `11.0.0-next.9`</p> <p>### Details</p> <p>AdonisJS parses `multipart/form-data` requests via the BodyParser package. During multipart parsing, form field names are used to construct plain JavaScript objects representing the parsed request body.</p> <p>Due to insufficient validation of multipart field names, specially crafted fields containing reserved property names such as `__proto__`, `constructor`, or `prototype` could be assigned directly to objects created during parsing. This allows an attacker to pollute object prototypes, potentially affecting other parts of the application that rely on these objects.</p> <p>**The vulnerability is limited to multipart request parsing and does not affect JSON or URL-encoded body parsing.**</p> <p>### Impact</p> <p>Exploitation requires an application endpoint that accepts and parses `multipart/form-data` requests.</p> <p>If exploited, prototype pollution may lead to unexpected application behavior, logic bypasses, or security issues depending on how polluted objects are later consumed. The severity of the impact depends on application logic and usage patterns of the parsed request data.</p> <p>### Patches</p> <p>Fixes target…</p> https://cve.radiocsirt.org/vuln/ghsa-f5x2-vj4h-vg4c