CVE-2026-48795

🗓️ 15 Jul 2026 21:23:14Reported by MendType

mend🔗 www.mend.io👁 12 Views

Prototype pollution in AdonisJS @adonisjs/bodyparser via nested multipart field payloads.

Reporter	Title	Published	Views	Family All 13
attackerkb	CVE-2026-48795	15 Jul 202621:23	–	attackerkb
Circl	CVE-2026-48795	16 Jul 202600:27	–	circl
CVE	CVE-2026-48795	15 Jul 202621:23	–	cve
Cvelist	CVE-2026-48795 Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser	15 Jul 202621:23	–	cvelist
EUVD	EUVD-2026-44822	15 Jul 202621:23	–	euvd
Github Security Blog	@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754	30 Jun 202618:34	–	github
NVD	CVE-2026-48795	15 Jul 202622:16	–	nvd
osv_cve	CVE-2026-48795 Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser	15 Jul 202621:23	–	osv_cve
osv_ghsa	GHSA-QCM7-3VPR-HJ5H @adonisjs/bodyparser has an incomplete fix for CVE-2026-25754	30 Jun 202618:34	–	osv_ghsa
Positive Technologies	PT-2026-54440	30 Jun 202600:00	–	ptsecurity

Vulners

Node

adonisjs bodyparserRange10.1.3–10.1.5

adonisjs bodyparserRange11.0.0-next.9–11.0.3

Source	Link
github	www.github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c
github	www.github.com/adonisjs/bodyparser/commit/aa96908f7b3f64c19e15d2d2d916b69137bdf469
github	www.github.com/adonisjs/core/security/advisories/GHSA-qcm7-3vpr-hj5h
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48795.json
github	www.github.com/adonisjs/bodyparser/releases/tag/v10.1.5
github	www.github.com/adonisjs/bodyparser/commit/8a85eb0c2061b0caca10faedbfc2cf24b56cf9f6
github	www.github.com/adonisjs/core
github	www.github.com/adonisjs/bodyparser/releases/tag/v11.0.3
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-48795
github	www.github.com/adonisjs/bodyparser/commit/40e1c71f958cffb74f6b91bed6630dca979062ed

07 Oct 2026 22:49Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.6

CVSS 48.8

EPSS0.00547

SSVC