Open redirect in AdonisJS HTTP Server through route parameters
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
AdonisJS HTTP Server (@adonisjs/http-server) before 8.2.3 and from 9.0.0 before 9.3.0 inserts route parameters into generated URLs without encoding them (CWE-601). If an application redirects to a route URL built from attacker-controlled data in a dynamic first path segment, a leading slash turns it into an external scheme-relative URL. An attacker can redirect users from the trusted application to a site they control, enabling phishing and abuse of authentication or OAuth flows.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| adonisjs | http-server | before 8.2.3; 9.0.0 to before 9.3.0 | 8.2.3, 9.3.0 | Patch available | CNA |
| — | @adonisjs/http-server (npm) | 9.0.0 to before 9.3.0 | 9.3.0 | Patch available | GHSA-2m6q-8v3h-jqww |
| — | @adonisjs/http-server (npm) | before 8.2.3 | 8.2.3 | Patch available | GHSA-2m6q-8v3h-jqww |
- http-server Vendoradonisjs Affected before 8.2.3; 9.0.0 to before 9.3.0 Fixed in 8.2.3, 9.3.0 Patch available CNA
- @adonisjs/http-server (npm) Vendor— Affected 9.0.0 to before 9.3.0 Fixed in 9.3.0 Patch available GHSA-2m6q-8v3h-jqww
- @adonisjs/http-server (npm) Vendor— Affected before 8.2.3 Fixed in 8.2.3 Patch available GHSA-2m6q-8v3h-jqww
Remediation
Update @adonisjs/http-server to 8.2.3 or 9.3.0. Red Hat lists Node HealthCheck Operator and Red Hat Enterprise Linux 9 as affected with no fix planned, and Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Red Hat OpenShift AI (RHOAI) and Red Hat build of Apache Camel for Spring Boot 4 as affected with no fix available.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA http-server (adonisjs) Fixed in 8.2.3, 9.3.0
- Fix · GHSA-2m6q-8v3h-jqww @adonisjs/http-server (npm) Fixed in 9.3.0 Advisory →
- Fix · GHSA-2m6q-8v3h-jqww @adonisjs/http-server (npm) Fixed in 8.2.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107718
- 2026-10-09 Alias added: GHSA-2m6q-8v3h-jqww
- 2026-10-10 Priority changed: MEDIUM → LOW
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
References
Other 6
- https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww
- https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d
- https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a
- https://github.com/adonisjs/http-server/releases/tag/v8.2.3
- https://github.com/adonisjs/http-server/releases/tag/v9.3.0
- https://github.com/adonisjs/http-server
More adonisjs vulnerabilities
- TI-2026-74653 Regex backtracking in AdonisJS HTTP Server slug matcher exhausts CPU CVSS 4.0HIGH 8.7
- TI-2026-36065 Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser CVSS 3.1HIGH 8.6
- TI-2026-17325 AdonisJS Path Traversal in Multipart File Handling CVSS 4.0CRITICAL 9.2
- TI-2026-18330 Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State CVSS 4.0HIGH 8.2
- TI-2026-20829 Uncontrolled resource consumption in adonisjs core CVSS 3.1HIGH 7.5
- TI-2026-20822 AdonisJS multipart body parsing has Prototype Pollution issue CVSS 3.1HIGH 7.2
Sources
- CVE-2026-107718 · CVE Program
- CVE-2026-107718 · NVD
- FIRST EPSS
- GHSA-2m6q-8v3h-jqww · GitHub Advisory Database · CC BY 4.0
- CVE-2026-107718 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences