AdonisJS framework is vulnerable to a memory‑exhaustion flaw that occurs during multipart file upload processing. The multipart parser in the @adonisjs/bodyparser package may accumulate an unbounded amount of data while trying to detect the file type, allowing an attacker to cause excessive memory consumption and eventual process termination. The weakness corresponds to resource consumption and memory exhaustion (CWE‑400, CWE‑770).

The issue affects the AdonisJS core library, specifically the bodyparser component prior to releases 10.1.3 and 11.0.0‑next.9. Systems running AdonisJS applications that accept file uploads and are using older versions of @adonisjs/bodyparser are vulnerable.

The vulnerability has a CVSS score of 7.5 and an EPSS score below 1%, indicating a moderate risk and very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, based on the fact that an attacker can craft a multipart upload with large payloads. No privilege escalation is required; the DoS can be triggered by any user who can submit a file to the application.