AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0‑next.9, multipart form‑data parsing contains a prototype pollution vulnerability that can be exploited by a remote attacker to manipulate JavaScript object prototypes at runtime. This flaw can alter application behavior, potentially enabling malicious code execution or data tampering if the polluted prototypes influence subsequent logic.

The vulnerability affects the AdonisJS core library, specifically the bodyparser middleware used for multipart form data. All versions of adonisjs:core released before v10.1.3 and before the v11.0.0‑next.9 release are impacted. Upgrading to v10.1.3 or v11.0.0‑next.9 and later mitigates the issue.

The CVSS score of 7.2 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is currently expected to be rare. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to send a crafted multipart form‑data request to an exposed endpoint that uses the bodyparser; the flaw is exploitable remotely without authentication, therefore the attack vector is inferred to be network-based.