CVE-2026-48795: Adonisjs Core

High severity, CVSS 8.6. EPSS: 0.5% chance of exploitation in the next 30 days.

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3.

Affected products

• Adonisjs Core: from 10.1.3, before 10.1.5 (fixed in 10.1.5); from 11.0.0-next.9, before 11.0.3 (fixed in 11.0.3)

Published 2026-07-15. Last modified 2026-07-16.