npm/@adonisjs/bodyparser CVE-2026-21440: critical, EPSS 1.03%
AdonisJS Path Traversal in Multipart File Handling
Action: Upgrade @adonisjs/bodyparser to 10.1.2 or later.
npm i @adonisjs/bodyparser@10.1.2npm i @adonisjs/bodyparser@11.0.0-next.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.1.2 | - |
| 11.0.0-next.0 | 11.0.0-next.6 | - |
Fixed versions
| 10.1.2 | 11.0.0-next.6 |
Sources
- osv: GHSA-gvq6-hvvp-h34h
- https://github.com/adonisjs/core/security/advisories/GHSA-gvq6-hvvp-h34h
- https://nvd.nist.gov/vuln/detail/CVE-2026-21440
- https://github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6
- https://github.com/adonisjs/bodyparser/commit/6795c0e3fa824ae275bbd992aae60609e96f0f03
- https://github.com/adonisjs/bodyparser/releases/tag/v10.1.2
- https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.6
- https://github.com/adonisjs/core
CVE-2026-21440 · published · modified · JSON