AIKIDO-2026-11053

TL;DR

The FormFields class in @adonisjs/bodyparser stores parsed multipart fields by calling lodash.set on its internal container, which creates intermediate plain objects for every path segment. A remote attacker submitting a crafted multipart request can pollute Object.prototype, affecting all subsequent objects and enabling logic bypasses, denial of service, or further exploitation depending on downstream code. The fix tokenizes each key with lodash.toPath and rejects any field whose segments include __proto__, prototype, or constructor.