CVE-2026-48795 Details
Description
AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3.
A vulnerability in AdonisJS @adonisjs/bodyparser versions 10.1.3 prior to 10.1.5 and 11.0.0-next.9 prior to 11.0.3 allows for nested prototype pollution. The issue arises because the initial fix for a related vulnerability (CVE-2026-25754) was incomplete. While the original patch prevented direct prototype pollution, it failed to address nested payloads that still managed to pollute Object.prototype. This vulnerability can be exploited remotely through an unauthenticated multipart/form-data request, leading to potential authorization bypasses, unexpected behavior in downstream libraries, or even remote code execution in certain scenarios.
Users should upgrade to AdonisJS @adonisjs/bodyparser versions 10.1.5 or 11.0.3, both of which include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/adonisjs/bodyparser/commit/8a85eb0c2061b0caca10faedbfc2cf24b56cf9f6 | [email protected] | Source CodeVendor |
| https://github.com/adonisjs/bodyparser/commit/aa96908f7b3f64c19e15d2d2d916b69137bdf469 | [email protected] | Source CodeVendor |
| https://github.com/adonisjs/bodyparser/releases/tag/v10.1.5 | [email protected] | Release NotesVendor |
| https://github.com/adonisjs/bodyparser/releases/tag/v11.0.3 | [email protected] | Release NotesVendor |
| https://github.com/adonisjs/core/security/advisories/GHSA-qcm7-3vpr-hj5h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AdonisJS Bodyparser | >= 10.1.3, < 10.1.5 (semver) >= 11.0.0-next.9, < 11.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |