CVE-2026-48795highCWE-1321

CVE-2026-48795: falha de alta gravidade em adonisjs core

Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar core+ Monitorar @adonisjs/bodyparser

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.5%
AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Produtos afetados
adonisjs · core
CVEs relacionadas — adonisjs core

No mesmo produto, das mais perigosas para as menos.

CVE-2026-21440CRITICALAdonisJS Path Traversal in Multipart File HandlingEPSS 1.0%CVE-2026-25762HIGHAdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type DetectionEPSS 0.5%CVE-2026-25754HIGHAdonisJS multipart body parsing has Prototype Pollution issueEPSS 0.4%