A critical prototype pollution vulnerability in the AdonisJS bodyparser component allows unauthenticated remote attackers to compromise application logic and integrity.

This is a prototype pollution vulnerability (CWE-1321) occurring within the multipart form-data parsing logic. An unauthenticated attacker can exploit this flaw to inject malicious properties into the global object prototype, potentially altering application behavior or leading to further exploitation.

The ability to manipulate object prototypes can lead to unauthorized modification of application state, potentially resulting in remote code execution or significant data integrity loss. Given the CVSS score of 7.2, this vulnerability represents a high risk to business operations, as it allows for predictable exploitation via the network without requiring any user interaction or authentication.

Immediate Action: Update the @adonisjs/bodyparser package to version 10.1.3 or 11.0.0-next.9 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor application logs for unusual multipart form-data submissions or unexpected object property behaviors that may indicate active testing for prototype pollution.

Compensating Controls: Deploy a Web Application Firewall with rules configured to inspect multipart/form-data payloads for suspicious property assignments or patterns associated with prototype pollution.

Public Exploit Available: No (unknown)

The severity of this flaw necessitates immediate attention from development and operations teams. Because the vulnerability is automatable and affects the core parsing logic, the risk of exploitation is elevated. Please prioritize the deployment of the patched versions to ensure the integrity of your AdonisJS applications.