Go to packages list

adonisjs-http-server

Ecosystem: npm

Downloads: 874.92 K

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 0HighAffects 0 versions
  • 0MediumAffects 0 versions
  • 3ModerateAffects 6 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High0 (0.0%)
  • Medium0 (0.0%)
  • Moderate3 (100.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 2
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting adonisjs-http-server, based on data from OSV.

Vulnerabilities affecting adonisjs-http-server
IDSeveritySummaryAffected versionsPublishedSource
GHSA-524c-h47v-m3h8ModerateAdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity### Description A Regular Expression Denial of Service vulnerability in the built-in AdonisJS slug route matcher may allow a remote attacker to block the Node.js event loop using a specially crafted URL. This affects applications using `router.matchers.slug()` on a route parameter reachable by an attacker. ### Details The regular expression used by `router.matchers.slug()` contains adjacent greedy quantifiers with overlapping character classes: ```regex /^[^\s-_](?!.*?[-_]{2,})([a-z0-9-\\]{1,})[^\s]*[^-_\s]$/ ``` When the matcher receives a long string ending with a character rejected by
  • >= 9.0.0, < 9.1.1
  • < 8.2.2
GitHub (opens in a new tab)
GHSA-2m6q-8v3h-jqwwModerateAdonisJS: Unencoded route parameters can produce open redirectsRoute parameters are inserted into generated URLs without URI encoding. When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example: ```ts router.get('/:page', handler).as('pages.show') response.redirect().toRoute('pages.show', { page: '/evil.example.com', }) ``` This generates the following redirect: ```http Location: //evil.example.com ``` Browsers interpret this value as an external URL and redirect the user to `https://evil.example.com`. ## Details The shared `createURL()` helpe
  • >= 9.0.0, < 9.3.0
  • < 8.2.3
GitHub (opens in a new tab)
GHSA-6qvv-pj99-48qmModerate@adonisjs/http-server has an Open Redirect vulnerability### Impact The `response.redirect().back()` method in `@adonisjs/http-server` is vulnerable to open redirects. The method reads the `Referer` header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the `Referer` header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use `response.redirect().back()` or `response.redirect('back')`. The vulnerability is classified as
  • >= 8.0.0-next.0, < 8.2.0
  • < 7.8.1
GitHub (opens in a new tab)
  • GHSA-524c-h47v-m3h8Moderate
    AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
    • >= 9.0.0, < 9.1.1
    • < 8.2.2
    GitHub (opens in a new tab)

    ### Description A Regular Expression Denial of Service vulnerability in the built-in AdonisJS slug route matcher may allow a remote attacker to block the Node.js event loop using a specially crafted URL. This affects applications using `router.matchers.slug()` on a route parameter reachable by an attacker. ### Details The regular expression used by `router.matchers.slug()` contains adjacent greedy quantifiers with overlapping character classes: ```regex /^[^\s-_](?!.*?[-_]{2,})([a-z0-9-\\]{1,})[^\s]*[^-_\s]$/ ``` When the matcher receives a long string ending with a character rejected by

    CVE: CVE-2026-104150

  • GHSA-2m6q-8v3h-jqwwModerate
    AdonisJS: Unencoded route parameters can produce open redirects
    • >= 9.0.0, < 9.3.0
    • < 8.2.3
    GitHub (opens in a new tab)

    Route parameters are inserted into generated URLs without URI encoding. When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example: ```ts router.get('/:page', handler).as('pages.show') response.redirect().toRoute('pages.show', { page: '/evil.example.com', }) ``` This generates the following redirect: ```http Location: //evil.example.com ``` Browsers interpret this value as an external URL and redirect the user to `https://evil.example.com`. ## Details The shared `createURL()` helpe

    CVE: CVE-2026-107718

  • GHSA-6qvv-pj99-48qmModerate
    @adonisjs/http-server has an Open Redirect vulnerability
    • >= 8.0.0-next.0, < 8.2.0
    • < 7.8.1
    GitHub (opens in a new tab)

    ### Impact The `response.redirect().back()` method in `@adonisjs/http-server` is vulnerable to open redirects. The method reads the `Referer` header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the `Referer` header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use `response.redirect().back()` or `response.redirect('back')`. The vulnerability is classified as

    CVE: CVE-2026-40255

Showing 1-3 of 3 vulnerabilities