CVE-2026-48795: AdonisJS Prototype Pollution Vulnerability

CVE-2026-48795 Overview

CVE-2026-48795 is a prototype pollution vulnerability [CWE-1321] in the AdonisJS @adonisjs/bodyparser package. The flaw affects versions from 10.1.3 until 10.1.5 and 11.0.3. The issue is an incomplete fix for CVE-2026-25754. Nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still reach lodash _.set() through @poppinss/utils. The helper creates plain intermediate objects and pollutes Object.prototype. Attackers can send crafted multipart form data over the network without authentication or user interaction. Maintainers resolved the issue in versions 10.1.5 and 11.0.3.

Critical Impact
Unauthenticated remote attackers can pollute Object.prototype through crafted multipart form fields, enabling application-wide behavior tampering and denial of service.

Affected Products

@adonisjs/bodyparser versions 10.1.3 through versions prior to 10.1.5
@adonisjs/bodyparser versions prior to 11.0.3
Applications built on AdonisJS that transitively depend on @poppinss/utils lodash _.set()

Discovery Timeline

2026-07-15 - CVE-2026-48795 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-48795

Vulnerability Analysis

AdonisJS is a TypeScript-first web framework. Its @adonisjs/bodyparser package processes incoming HTTP request bodies, including multipart form fields. The framework converts dotted field names into nested object structures using lodash _.set() from @poppinss/utils.

The previous fix for CVE-2026-25754 blocked direct pollution attempts but did not sanitize nested variants. Payloads such as user.__proto__.polluted or nested.constructor.prototype.tainted traverse through _.set(), which walks the property path and creates intermediate plain objects. When one of those segments resolves to __proto__, prototype, or constructor, writes reach Object.prototype and affect every object in the runtime.

Root Cause

The form_fields.ts module accepted arbitrary dotted key names from user-supplied form fields and forwarded them to lodash _.set() without validating individual path segments. _.set() follows the property chain and writes through inherited accessors, allowing modification of the base Object.prototype.

Attack Vector

An unauthenticated attacker submits an HTTP multipart request to any endpoint parsed by @adonisjs/bodyparser. Field names such as constructor.prototype.isAdmin=true cause the parser to write isAdmin onto Object.prototype. Subsequent code paths that read isAdmin on any object observe the polluted value. Depending on downstream logic, this can lead to authorization bypass, logic corruption, or process crashes.

typescript

// Patch: src/form_fields.ts
import lodash from '@poppinss/utils/lodash'

const PROTOTYPE_POLLUTING_KEYS = new Set(['__proto__', 'prototype', 'constructor'])

/**
 * A jar of form fields to store form data by handling
 * array gracefully
 */

Source: AdonisJS Commit 8a85eb0 and AdonisJS Commit aa96908. The fix introduces a PROTOTYPE_POLLUTING_KEYS deny list that rejects __proto__, prototype, and constructor segments before they reach lodash _.set().

Detection Methods for CVE-2026-48795

Indicators of Compromise

HTTP request bodies containing multipart field names with __proto__, prototype, or constructor segments
Unexpected property writes on Object.prototype observed at runtime through diagnostic hooks or heap snapshots
Application-wide behavior changes such as global default flags, roles, or configuration values appearing without corresponding code changes

Detection Strategies

Inspect access logs and web application firewall telemetry for request bodies matching regular expressions like (__proto__|constructor\.prototype|prototype\.)
Add runtime guards that call Object.getOwnPropertyNames(Object.prototype) at intervals and alert on new property names
Scan dependency manifests for @adonisjs/bodyparser versions in the vulnerable ranges 10.1.3 through 10.1.4 and any release below 11.0.3

Monitoring Recommendations

Forward AdonisJS request logs and Node.js process metrics into a centralized analytics platform for pattern searches on prototype pollution payloads
Enable alerting on unusual authorization outcomes such as sudden increases in admin-only endpoint access
Track dependency drift with software composition analysis to flag reintroduction of vulnerable @adonisjs/bodyparser versions

How to Mitigate CVE-2026-48795

Immediate Actions Required

Upgrade @adonisjs/bodyparser to version 10.1.5 or 11.0.3 immediately using your package manager
Audit all AdonisJS applications and internal libraries that transitively depend on @poppinss/utils lodash _.set()
Review recent request logs for multipart field names containing __proto__, prototype, or constructor

Patch Information

The maintainers released fixes in AdonisJS Release v10.1.5 and AdonisJS Release v11.0.3. The patch adds a PROTOTYPE_POLLUTING_KEYS set to src/form_fields.ts and skips any nested field segment matching __proto__, prototype, or constructor. Full details are documented in AdonisJS Security Advisory GHSA-qcm7-3vpr-hj5h.

Workarounds

Deploy a WAF rule or reverse proxy filter to reject multipart form field names containing __proto__, prototype, or constructor
Freeze Object.prototype at application startup with Object.freeze(Object.prototype) to block runtime writes
Add middleware that validates request body key names before controllers process them

bash

# Upgrade to a fixed release
npm install @adonisjs/bodyparser@^10.1.5
# or for the 11.x line
npm install @adonisjs/bodyparser@^11.0.3

# Verify installed version
npm ls @adonisjs/bodyparser