Executive brief
AdonisJS is a web development framework used to build server-side applications. A security flaw in its data processing component allows unauthenticated attackers to send specially crafted requests that interfere with the application's core memory. This can lead to service outages, bypasses of security controls, or potentially allow attackers to take control of the server.
Technical details
The vulnerability is a prototype pollution (CWE-1321) in the @adonisjs/bodyparser component of the AdonisJS framework. While a previous fix (CVE-2026-25754) used Object.create(null) to prevent direct prototype access, it failed to account for nested payloads. When processing multipart/form-data, the lodash _.set() function (via @poppinss/utils) creates plain intermediate objects for nested keys. An attacker can provide a payload like 'user.__proto__.polluted' to bypass the initial protection and modify Object.prototype. This is exploitable remotely without authentication on any route using the BodyParserMiddleware. The issue is resolved in versions 10.1.5 and 11.0.3.
Affected products
- AdonisJS @adonisjs/bodyparser >= 10.1.3, < 10.1.5; >= 11.0.0-next.9, < 11.0.3
Timeline
- 2026-05-22: patched: Fixes released in v10.1.5 and v11.0.3
- 2026-05-28: advisory: GitHub Security Advisory GHSA-qcm7-3vpr-hj5h published
- 2026-07-15: disclosed: CVE-2026-48795 published to NVD
References
- https://github.com/adonisjs/bodyparser/commit/8a85eb0c2061b0caca10faedbfc2cf24b56cf9f6
- https://github.com/adonisjs/bodyparser/commit/aa96908f7b3f64c19e15d2d2d916b69137bdf469
- https://github.com/adonisjs/bodyparser/releases/tag/v10.1.5
- https://github.com/adonisjs/bodyparser/releases/tag/v11.0.3
- https://github.com/adonisjs/core/security/advisories/GHSA-qcm7-3vpr-hj5h