CVE-2026-48795

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48795
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48795.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48795
Aliases
Published
2026-07-15T21:23:14.393Z
Modified
2026-08-04T11:51:04.238036454Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
Summary
Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser
Details

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.proto.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3.

Database specific 
{
    "cwe_ids": [
        "CWE-1321"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48795.json"
}
References

Affected packages

Git / github.com/adonisjs/bodyparser

Affected ranges

Type
GIT
Repo
https://github.com/adonisjs/bodyparser
Events
Introduced
f1fc24651f9813b8749db97b60225052ca6f191c
Fixed
9a07f80a0d1b25067135b946b47c192214eb0370
Introduced
05ccbc9933e70cb99c650d837e2d2c547df4eb64
Fixed
6c9f9c00c127d6b5727a0850e116ae8ec21525ed
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "10.1.3"
        },
        {
            "fixed": "10.1.5"
        },
        {
            "introduced": "11.0.0-next.9"
        },
        {
            "fixed": "11.0.3"
        }
    ]
}

Affected versions

v10.*
v10.1.3
v10.1.4
v11.*
v11.0.0
v11.0.0-next.9
v11.0.1
v11.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48795.json"