CVE-2026-48795

Name of the Vulnerable Software and Affected Versions AdonisJS versions 10.1.3 through 10.1.4 AdonisJS versions 11.0.0-next.9 through 11.0.2

Description An incomplete fix in the @adonisjs/bodyparser module allows for prototype pollution via nested multipart field payloads. While direct payloads are blocked, using a non-dangerous segment before proto or constructor.prototype (e.g., user. proto .polluted) allows the lodash .set() function, used via @poppinss/utils, to create plain intermediate objects and pollute Object.prototype. This can be exploited remotely by an unauthenticated attacker through a single multipart/form-data request on any route using BodyParserMiddleware. Prototype pollution is a vulnerability where an attacker can manipulate the base object prototype, potentially leading to authorization bypasses, unexpected application behavior, or remote code execution through gadget chains.

Recommendations Update AdonisJS to version 10.1.5. Update AdonisJS to version 11.0.3.