Platform
nodejs
Component
@adonisjs/bodyparser
Fixed in
10.1.3
11.0.1
10.1.2
CVE-2026-21440 describes a Path Traversal vulnerability within the @adonisjs/bodyparser library, a Node.js middleware for parsing request bodies. This flaw allows a remote attacker to write arbitrary files to the server's filesystem, potentially leading to complete system compromise. The vulnerability affects versions of @adonisjs/bodyparser up to 10.1.1 and prerelease versions of 11.x before 11.0.0-next.6. A patch has been released in version 10.1.2 and 11.0.0-next.6.
The core of the vulnerability lies in the MultipartFile.move(location, options) function within @adonisjs/bodyparser. The default options for this function are insufficiently restrictive, allowing an attacker to manipulate the location parameter to write files outside of the intended upload directory. This can be exploited by crafting malicious multipart/form-data requests that include a carefully crafted filename. Successful exploitation could allow an attacker to overwrite critical system files, execute arbitrary code, or gain persistent access to the server. The blast radius extends to any application utilizing @adonisjs/bodyparser for file uploads, potentially impacting sensitive data and system integrity.
This vulnerability was publicly disclosed on January 2, 2026. While no active exploitation campaigns have been publicly confirmed, the CRITICAL severity and ease of exploitation suggest a high likelihood of future attacks. There are currently no known public proof-of-concept exploits, but the vulnerability's nature makes it relatively straightforward to develop. The vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.11% (29% percentile)
CISA SSVC
The primary mitigation for CVE-2026-21440 is to immediately upgrade to @adonisjs/bodyparser version 10.1.2 or 11.0.0-next.6 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious filenames or path traversal sequences in the location parameter. Additionally, restrict file upload permissions to the minimum necessary and implement strict input validation to prevent malicious filenames from being processed. Review and harden the application's file handling logic to ensure that uploaded files are stored in a secure location and are properly sanitized before use. After upgrading, confirm the fix by attempting to upload a file with a path traversal payload (e.g., ../../../../etc/passwd) and verifying that the upload fails with an appropriate error.
Update the @adonisjs/bodyparser package to version 10.1.2 or higher, or to version 11.0.0-next.6 or higher. This will correct the Path Traversal vulnerability. Run `npm update @adonisjs/bodyparser` or `yarn upgrade @adonisjs/bodyparser` to update the package.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-21440 is a CRITICAL Path Traversal vulnerability in @adonisjs/bodyparser, allowing attackers to write arbitrary files to the server. It affects versions up to 10.1.1 and prereleases before 11.0.0-next.6.
You are affected if your application uses @adonisjs/bodyparser versions up to 10.1.1 or prerelease versions of 11.x before 11.0.0-next.6.
Upgrade to @adonisjs/bodyparser version 10.1.2 or 11.0.0-next.6 or later. Consider WAF rules and input validation as temporary mitigations.
While no active exploitation campaigns have been publicly confirmed, the CRITICAL severity suggests a high likelihood of future attacks.
Refer to the official AdonisJS security advisories and release notes for details: [https://github.com/adonisjs/body-parser/releases](https://github.com/adonisjs/body-parser/releases)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.