Adonisjs vulnerabilities
We track 6 vulnerabilities in Adonisjs products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest Adonisjs vulnerabilities
- 8.7 High severity
http-server: Uncontrolled Resource Consumption
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an applica
- 8.6 High severity
core: Improperly Controlled Modification of Object Prototype Attributes
AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lo
- 7.5 High severity
core: Uncontrolled Resource Consumption
AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumu
- 7.2 High severity
core: Improperly Controlled Modification of Object Prototype Attributes
AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been pa
- 8.2 High severity
lucid: Improperly Controlled Modification of Dynamically-Determined Object Attributes
@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments
- 9.2 Critical severity
core: Improper Limitation of a Pathname to a Restricted Directory
AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through ver