CVE-2026-107718 · GHSA-2m6q-8v3h-jqww
AdonisJS: Unencoded route parameters can produce open redirects
- Risk score
- 46/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application place…
- Affected
- @adonisjs/http-server (npm) >= 9.0.0, <= 9.2.0; @adonisjs/http-server (npm) <= 8.2.2
- Fix
- Upgrade @adonisjs/http-server to 9.3.0 or 8.2.3 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
@adonisjs/http-server: Amber, patch this week. AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route p…
The flaws
- CVE-2026-107718: AdonisJS: Unencoded route parameters can produce open redirects (CVSS 6.1 · EPSS 0%)
- CVE-2026-104150: AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity (CVSS 8.7 · EPSS 0%)
The fix
Upgrade @adonisjs/http-server: 8.2.3 · 9.3.0 · 8.2.2 · 9.1.1 or later on your release line
Who is exposed: @adonisjs/http-server (npm) >= 9.0.0, < 9.1.1; @adonisjs/http-server (npm) <= 8.2.1
Where it stands
- No known exploitation
Connects to
- Same weakness: Open redirect (CWE-601). 20 other warnings in 30 days
Why it is Yellow
- CVSS 6.1 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @adonisjs/http-server | npm | >= 9.0.0, <= 9.2.0 | 9.3.0 |
| @adonisjs/http-server | npm | <= 8.2.2 | 8.2.3 |
References
- https://github.com/advisories/GHSA-2m6q-8v3h-jqww
- https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww
- https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d
- https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a
- https://github.com/adonisjs/http-server/releases/tag/v8.2.3
- https://github.com/adonisjs/http-server/releases/tag/v9.3.0
- https://github.com/advisories/GHSA-2m6q-8v3h-jqww
Original description
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.
Last activity 8 Oct 2026. Patch Forecast updates every hour.