CVE-2026-104150 · GHSA-524c-h47v-m3h8
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
- Risk score
- 68/100
- CVSS
- 8.7 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route p…
- Affected
- @adonisjs/http-server (npm) >= 9.0.0, < 9.1.1; @adonisjs/http-server (npm) <= 8.2.1
- Fix
- Upgrade @adonisjs/http-server to 9.1.1 or 8.2.2 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
@adonisjs/http-server: Amber, patch this week. AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route p…
The flaws
- CVE-2026-104150: AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity (CVSS 8.7 · EPSS 0%)
- CVE-2026-107718: AdonisJS: Unencoded route parameters can produce open redirects (CVSS 6.1 · EPSS 0%)
The fix
Upgrade @adonisjs/http-server: 8.2.2 · 9.1.1 · 8.2.3 · 9.3.0 or later on your release line
Who is exposed: @adonisjs/http-server (npm) >= 9.0.0, < 9.1.1; @adonisjs/http-server (npm) <= 8.2.1
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-400). 253 other warnings in 30 days
Why it is Amber
- CVSS 8.7 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @adonisjs/http-server | npm | >= 9.0.0, < 9.1.1 | 9.1.1 |
| @adonisjs/http-server | npm | <= 8.2.1 | 8.2.2 |
References
- https://github.com/advisories/GHSA-524c-h47v-m3h8
- https://github.com/adonisjs/http-server/security/advisories/GHSA-524c-h47v-m3h8
- https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7
- https://github.com/adonisjs/http-server/commit/d8c749aa9f66d5d214bad1cad727264aef4be727
- https://github.com/adonisjs/http-server/releases/tag/v8.2.2
- https://github.com/adonisjs/http-server/releases/tag/v9.1.1
- https://github.com/advisories/GHSA-524c-h47v-m3h8
Original description
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.
Last activity 15 Oct 2026. Patch Forecast updates every hour.