{"id":"CVE-2026-48795","revision":"37f1071916c240ce8013535bce4a33b1","records":[{"revision":"37f1071916c240ce8013535bce4a33b1","observedAt":"2026-10-25T12:17:32.273+00:00","statement":{"source":"nvd","id":"CVE-2026-48795","aliases":[],"title":"AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.proto…","description":"AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3.","state":0,"publishedAt":"2026-07-15T22:16:50.383+00:00","modifiedAt":"2026-10-24T21:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":8.6,"severity":"HIGH"}],"references":["https://github.com/adonisjs/bodyparser/commit/8a85eb0c2061b0caca10faedbfc2cf24b56cf9f6","https://github.com/adonisjs/bodyparser/commit/aa96908f7b3f64c19e15d2d2d916b69137bdf469","https://github.com/adonisjs/bodyparser/releases/tag/v10.1.5","https://github.com/adonisjs/bodyparser/releases/tag/v11.0.3","https://github.com/adonisjs/core/security/advisories/GHSA-qcm7-3vpr-hj5h"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48795","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-1321"],"productCriteria":[],"sourceDates":{"published":"2026-07-15T22:16:50.383","lastModified":"2026-10-24T21:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-48795","identifiers":["CVE-2026-48795"]},"retained":false,"historicalAffected":[]}],"coverage":[]}