adonisjs

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

adonisjs records in CISA KEV

No adonisjs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Bodyparser 2 records MEDIUM Core 1 record LOW Edge 1 record LOW Http-server 1 record LOW

Records

10 records

TI-2026-74653 CVE-2026-104150 · GHSA-524c-h47v-m3h8

Regex backtracking in AdonisJS HTTP Server slug matcher exhausts CPU

MEDIUM 44

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00367 Published 2026-10-15 Partial fix · 8.2.2, 9.1.1 CWE-1333

TI-2026-36065 CVE-2026-48795 · GHSA-qcm7-3vpr-hj5h

Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser

MEDIUM 44

AdonisJS is a TypeScript-first web framework.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00547 Published 2026-07-15 Fixed in 10.1.5, 11.0.3 CWE-1321

TI-2026-17325 CVE-2026-21440 · GHSA-gvq6-hvvp-h34h

AdonisJS Path Traversal in Multipart File Handling

MEDIUM 44

AdonisJS is a TypeScript-first web framework.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01034 Published 2026-01-02 Fixed in 10.1.2, 11.0.0-next.6 CWE-22

TI-2026-18330 CVE-2026-22814 · GHSA-g5gc-h5hp-555f

Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State

MEDIUM 42

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00536 Published 2026-01-13 Fixed in 21.8.2, 22.0.0-next.6 CWE-915

TI-2026-20829 CVE-2026-25762 · GHSA-xx9g-fh25-4q64

Uncontrolled resource consumption in adonisjs core

MEDIUM 40

AdonisJS is a TypeScript-first web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00534 Published 2026-02-06 Fixed in 10.1.3, 11.0.0-next.9 CWE-400

TI-2026-20822 CVE-2026-25754 · GHSA-f5x2-vj4h-vg4c

AdonisJS multipart body parsing has Prototype Pollution issue

LOW 38

AdonisJS is a TypeScript-first web framework.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00417 Published 2026-02-06 Fixed in 10.1.3, 11.0.0-next.9 CWE-1321

TI-2021-06134 CVE-2021-23443 · GHSA-55r9-7mf8-m382

Cross-site scripting (XSS) in edge.js

LOW 29

This affects the package edge.js before 5.3.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00906 Published 2021-09-21 Fixed in 5.3.2 CWE-843

TI-2026-69677 CVE-2026-107718 · GHSA-2m6q-8v3h-jqww

Open redirect in AdonisJS HTTP Server through route parameters

LOW 27

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00278 Published 2026-10-08 Partial fix · 8.2.3, 9.3.0 CWE-601

TI-2026-44097 CVE-2026-61526

AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

LOW 27

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00338 Published 2026-07-30 Fixed in 8.2.1, 9.1.0 CWE-79

TI-2026-29049 CVE-2026-40255 · GHSA-6qvv-pj99-48qm

@adonisjs/http-server has an Open Redirect vulnerability

LOW 27

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00248 Published 2026-04-16 Fixed in 8.2.0, 7.8.1 +2 CWE-601

Open these records in search →

Critical	1
High	5
Medium	4
Low	0
No CVSS	0