« Volver al listado

CVE-2026-25762

Estado: AnalizadaAlta (7.5)—

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N/UI:N indica explotación remota sin privilegios (T1190). El texto describe consumo de memoria unbounded en el parser multipart → DoS por agotamiento de recursos (T1499.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Adonisjs — Bodyparser

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25762",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25762",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-09T15:21:47.910215Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "adonisjs",
          "product": "core",
          "versions": [
            {
              "status": "affected",
              "version": "< 10.1.3"
            },
            {
              "status": "affected",
              "version": "< 11.0.0-next.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-06T23:15:54.670",
  "references": [
    {
      "url": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.3",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9."
    },
    {
      "lang": "es",
      "value": "AdonisJS es un framework web TypeScript-first. Antes de las versiones 10.1.3 y 11.0.0-next.9, existe una vulnerabilidad de denegación de servicio (DoS) en la lógica de manejo de archivos multipart de @adonisjs/bodyparser. Al procesar cargas de archivos, el analizador multipart puede acumular una cantidad ilimitada de datos en memoria mientras intenta detectar tipos de archivo, lo que podría llevar a un consumo excesivo de memoria y a la terminación del proceso. Este problema ha sido parcheado en las versiones 10.1.3 y 11.0.0-next.9."
    }
  ],
  "lastModified": "2026-06-17T10:25:11.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adonisjs:bodyparser:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2D0EAB1-2749-484C-8CF3-C51E5E934279",
              "versionEndExcluding": "10.1.3"
            },
            {
              "criteria": "cpe:2.3:a:adonisjs:bodyparser:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "020CFEB2-5732-42CA-B05A-5BE722B7EC41",
              "versionEndExcluding": "11.0.0",
              "versionStartIncluding": "10.1.4"
            },
            {
              "criteria": "cpe:2.3:a:adonisjs:bodyparser:11.0.0:next1:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7CB148B-B37C-4BAB-8F9A-B2E028FDE19A"
            },
            {
              "criteria": "cpe:2.3:a:adonisjs:bodyparser:11.0.0:next2:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "250E3E4D-B54A-4AD9-93C0-D26DE41B8CF8"
            },
            {
              "criteria": "cpe:2.3:a:adonisjs:bodyparser:11.0.0:next3:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DFE6131-7D0C-4B69-B4C0-F77BA58E9F3F"
            },
            {
              "criteria": "cpe:2.3:a:adonisjs:bodyparser:11.0.0:next4:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99B68074-366C-4B96-909D-E49DFE3D240A"
            },
            {
              "criteria": "cpe:2.3:a:adonisjs:bodyparser:11.0.0:next5:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "349D208E-B74B-4BEE-9958-9E9FC7BB73BA"
            },
            {
              "criteria": "cpe:2.3:a:adonisjs:bodyparser:11.0.0:next6:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51559F52-A6DF-4CD4-A763-36AA17AFB0CB"
            },
            {
              "criteria": "cpe:2.3:a:adonisjs:bodyparser:11.0.0:next7:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCDAA05D-1138-4C7B-9AA8-1627996390C5"
            },
            {
              "criteria": "cpe:2.3:a:adonisjs:bodyparser:11.0.0:next8:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C3D4CD4-4DF6-440B-9D4D-E0E36273434A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}