Read the docs
TI-2026-44097 Aliases CVE-2026-61526

AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix Fixed http-server (adonisjs): 8.2.1, 9.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
adonisjshttp-server8.0.0-next.0 to before 8.2.1; 9.0.0 to before 9.1.08.2.1, 9.1.0Patch availableCNA
  • http-server Vendoradonisjs Affected 8.0.0-next.0 to before 8.2.1; 9.0.0 to before 9.1.0 Fixed in 8.2.1, 9.1.0 Patch available CNA

Remediation

  • Fix · CNA http-server (adonisjs) Fixed in 8.2.1, 9.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61526

References

Other 5

  • TI-2026-74653 Regex backtracking in AdonisJS HTTP Server slug matcher exhausts CPU CVSS 4.0HIGH 8.7
  • TI-2026-36065 Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser CVSS 3.1HIGH 8.6
  • TI-2026-17325 AdonisJS Path Traversal in Multipart File Handling CVSS 4.0CRITICAL 9.2
  • TI-2026-18330 Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State CVSS 4.0HIGH 8.2
  • TI-2026-20829 Uncontrolled resource consumption in adonisjs core CVSS 3.1HIGH 7.5
  • TI-2026-20822 AdonisJS multipart body parsing has Prototype Pollution issue CVSS 3.1HIGH 7.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences