CVE-2026-48795: 
JavaScript 취약성 분석 및 완화

CVE-2026-48795 is a prototype pollution vulnerability in the AdonisJS @adonisjs/bodyparser package, representing an incomplete fix for the prior advisory CVE-2026-25754 (GHSA-f5x2-vj4h-vg4c). The vulnerability affects @adonisjs/bodyparser versions >= 10.1.3 and < 10.1.5, and >= 11.0.0-next.9 and < 11.0.3. It was published on June 30, 2026, and patched versions were released on May 22, 2026. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution). The original fix for CVE-2026-25754 replaced the internal FormFields storage object with Object.create(null), which blocked direct payloads like __proto__.polluted. However, lodash's _.set() (invoked via @poppinss/utils) still creates plain intermediate objects ({}) when traversing nested path segments. This means that payloads prefixed with a benign segment — such as user.__proto__.polluted or user.constructor.prototype.polluted — bypass the null-prototype root object and successfully pollute Object.prototype. The fix introduces a blocklist (PROTOTYPE_POLLUTING_KEYS) checked against every path segment via lodash.toPath() before any _.set() call is made (GitHub Advisory, Patch Commit v10, Patch Commit v11).

Successful exploitation allows an unauthenticated remote attacker to pollute Object.prototype on any AdonisJS application route that accepts multipart/form-data requests via BodyParserMiddleware. Because the pollution is process-wide, downstream effects can include authorization bypasses, unexpected behavior in libraries that rely on inherited object properties, and potential exploitation of prototype pollution gadget chains leading to remote code execution. Confidentiality and integrity impacts are rated low, while availability impact is rated high (GitHub Advisory).

1. Identify target: Locate an AdonisJS application running @adonisjs/bodyparser versions >= 10.1.3 and < 10.1.5, or >= 11.0.0-next.9 and < 11.0.3, with at least one route accepting multipart/form-data requests behind BodyParserMiddleware.
2. Craft malicious payload: Construct a multipart/form-data HTTP request containing a field name that uses a nested prototype-polluting path, such as user.__proto__.polluted or user[__proto__][polluted] or user.constructor.prototype.polluted, with an attacker-controlled value.
3. Send the request: Submit the crafted request to any eligible endpoint (no authentication required). The bodyparser processes the field name through lodash.toPath() and passes it to _.set(), which traverses the path and sets the property on Object.prototype.
4. Achieve prototype pollution: The property is now set on Object.prototype for the entire Node.js process, meaning all plain objects in the application inherit the attacker-controlled property.
5. Leverage impact: Exploit the polluted prototype to trigger authorization bypasses, manipulate application logic that checks inherited properties, or chain with known prototype pollution gadgets in the dependency tree to escalate to remote code execution (GitHub Advisory).

• Network: Inbound HTTP POST requests to any route with Content-Type: multipart/form-data containing field names with segments such as __proto__, constructor, or prototype (e.g., user.__proto__.polluted, user[__proto__][polluted], user.constructor.prototype.x).
• Logs: Application access logs showing multipart/form-data POST requests with unusual field names containing double-underscore patterns or constructor/prototype keywords; Node.js error logs reflecting unexpected property inheritance or type errors in downstream libraries.
• Process: Unexpected application behavior such as authorization checks returning incorrect results, properties appearing on plain objects that were not explicitly set, or crashes in libraries sensitive to prototype chain modifications.

Upgrade @adonisjs/bodyparser to version 10.1.5 (for the v10 branch) or 11.0.3 (for the v11 branch), both released on May 22, 2026. The fix adds a PROTOTYPE_POLLUTING_KEYS blocklist (__proto__, prototype, constructor) and checks every path segment via lodash.toPath() before invoking _.set(), discarding any field whose path contains a dangerous segment. No configuration-based workaround is available; upgrading is the only recommended remediation (v10.1.5 Release, v11.0.3 Release).

The advisory was published by AdonisJS maintainer RomainLanz and credited to researcher EchoSkorJjj for discovery. The vulnerability was picked up by standard vulnerability aggregators (Tenable, VulnDB, OSV, ENISA EUVD) shortly after disclosure, and appeared in a CISA vulnerability bulletin. No significant independent researcher commentary or broad social media discussion has been identified beyond routine aggregation (GitHub Advisory).