AdonisJS is a TypeScript‑first web framework. In @adonisjs/bodyparser versions prior to 10.1.5 and 11.0.3, nested multipart fields such as user.__proto__.polluted or constructor.prototype are not fully escaped, enabling the @poppinss/utils dependency to use lodash _.set to create intermediate objects that overwrite properties on Object.prototype. This prototype pollution can be exploited by an attacker to alter globally shared properties, potentially compromising application integrity. The vulnerability is remedied in bodyparser releases 10.1.5 and 11.0.3.

The weakness applies to the AdonisJS core framework, specifically the @adonisjs/bodyparser package shipped with AdonisJS v10.1.3 through v10.1.4 and earlier 11.0.x releases. The vulnerability is fixed in the released versions 10.1.5 and 11.0.3, so any deployment using a pre‑10.1.5 or pre‑11.0.3 build of @adonisjs/bodyparser remains vulnerable.

The CVSS score of 8.6 indicates high severity, while the EPSS score of <1% points to a low current exploitation probability. The issue is not cataloged in CISA’s KEV list. Attackers can trigger the flaw by sending crafted multipart HTTP requests. If an application accepts such data without mitigating the nesting of object keys, Object.prototype can be polluted, potentially impacting application integrity.