{"action":"Upgrade @adonisjs/bodyparser to 10.1.5 or later.","affected":[{"fixed":"10.1.5","introduced":"10.1.3"},{"fixed":"11.0.3","introduced":"11.0.0-next.9"}],"component":"@adonisjs/bodyparser","cve_ids":["CVE-2026-48795"],"ecosystem":"npm","epss":0.00547,"exploited":false,"fixed_versions":["10.1.5","11.0.3"],"ghsa_id":"GHSA-qcm7-3vpr-hj5h","id":"tcs_01M5KG5XH9V6PXX2B8YW8MGMFP","modified_at":"2026-09-10T03:50:50.187122134Z","published_at":"2026-06-30T18:34:32Z","references":["https://osv.dev/vulnerability/GHSA-qcm7-3vpr-hj5h","https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c","https://github.com/adonisjs/core/security/advisories/GHSA-qcm7-3vpr-hj5h","https://github.com/adonisjs/bodyparser/commit/40e1c71f958cffb74f6b91bed6630dca979062ed","https://github.com/adonisjs/bodyparser/releases/tag/v10.1.5","https://github.com/adonisjs/bodyparser/releases/tag/v11.0.3","https://github.com/adonisjs/core"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-qcm7-3vpr-hj5h","url":"https://osv.dev/vulnerability/GHSA-qcm7-3vpr-hj5h"}],"summary":"@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754"}