The vulnerability in @adonisjs/bodyparser arises from an incomplete patch for CVE-2026-25754. The original fix replaced the internal FormFields storage with an object lacking a prototype to block direct prototype pollution payloads like '__proto__.polluted'. However, nested payloads containing a normal segment before '__proto__' or 'constructor.prototype' (e.g., 'user.__proto__.polluted') bypass this protection because lodash's _.set() creates intermediate plain objects that regain prototype access. This allows an unauthenticated attacker to remotely pollute Object.prototype via a single multipart/form-data request. The pollution affects the entire process, potentially leading to authorization bypass, unexpected behavior in dependent libraries, or prototype pollution gadget chains that could escalate to remote code execution. The issue affects versions >=10.1.3 <10.1.5 and >=11.0.0-next.9 <11.0.3. Fixed versions 10.1.5 and 11.0.3 have been released to address this vulnerability.

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted multipart/form-data request to any route using BodyParserMiddleware. This results in process-wide Object.prototype pollution, which may cause authorization bypasses, unexpected behavior in downstream libraries, or enable prototype pollution gadget chains that could lead to remote code execution.

Users should upgrade to @adonisjs/bodyparser versions 10.1.5 or later, or 11.0.3 or later, where this vulnerability has been fixed. The vendor has published official patches addressing this issue. Until upgraded, the vulnerability remains exploitable. No other mitigations are indicated by the vendor advisory.