p PatchFirst

CVE-2026-22814

CVE-2026-22814 · Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State

This page contains facts from public vulnerability sources. Check the original advisory before updating.

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.

CVSS 8.2 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • lucid

    Versions
    • < 21.8.2: Affected
    • >= 22.0.0-next.0, < 22.0.0-next.6: Affected

    No fix published

  • @adonisjs/lucid npm

    Affected ranges
    • SEMVER: < 21.8.2

    Update to 21.8.2

  • @adonisjs/lucid npm

    Affected ranges
    • SEMVER: ≥ 22.0.0-next.0, < 22.0.0-next.6

    Update to 22.0.0-next.6

Original sources

Check your server →