Read the docs
TI-2026-74653 Aliases CVE-2026-104150GHSA-524c-h47v-m3h8

Regex backtracking in AdonisJS HTTP Server slug matcher exhausts CPU

Priority MEDIUM 44CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

AdonisJS HTTP Server (@adonisjs/http-server) is affected before 8.2.2 and from 9.0.0 before 9.1.1. The regular expression returned by router.matchers.slug() has adjacent greedy repetitions with overlapping character classes, which causes quadratic backtracking (CWE-1333). An unauthenticated remote attacker sends a long slug in a route parameter, which blocks the Node.js event loop. Route matching runs before middleware, so authentication and rate limiting may not stop it.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix Partial http-server (adonisjs): 8.2.2, 9.1.1@adonisjs/http-server (npm): 9.1.1, 8.2.2Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
adonisjshttp-serverbefore 8.2.2; 9.0.0 to before 9.1.18.2.2, 9.1.1Patch availableCNA
—@adonisjs/http-server (npm)9.0.0 to before 9.1.19.1.1Patch availableGHSA-524c-h47v-m3h8
—@adonisjs/http-server (npm)before 8.2.28.2.2Patch availableGHSA-524c-h47v-m3h8
  • http-server Vendoradonisjs Affected before 8.2.2; 9.0.0 to before 9.1.1 Fixed in 8.2.2, 9.1.1 Patch available CNA
  • @adonisjs/http-server (npm) Vendor— Affected 9.0.0 to before 9.1.1 Fixed in 9.1.1 Patch available GHSA-524c-h47v-m3h8
  • @adonisjs/http-server (npm) Vendor— Affected before 8.2.2 Fixed in 8.2.2 Patch available GHSA-524c-h47v-m3h8

Remediation

Upgrade @adonisjs/http-server to 8.2.2 on the 8.x line and to 9.1.1 on the 9.x line. Red Hat fixes this in Red Hat OpenShift AI 3.4 with RHSA-2026:92510, released 2026-10-29. Red Hat's plan is none available for Node HealthCheck Operator, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and Red Hat OpenShift AI (RHOAI).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA http-server (adonisjs) Fixed in 8.2.2, 9.1.1
  • Fix · GHSA-524c-h47v-m3h8 @adonisjs/http-server (npm) Fixed in 9.1.1 Advisory →
  • Fix · GHSA-524c-h47v-m3h8 @adonisjs/http-server (npm) Fixed in 8.2.2 Advisory →

Red Hat 1 advisory

  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Node HealthCheck OperatorAffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift AI 3.4Fixed RHSA-2026:92510
Not affected: 6 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift AI 3.4
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-104150
  2. 2026-10-16 Alias added: GHSA-524c-h47v-m3h8
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-16 CVSS score added · Red Hat
  5. 2026-10-20 Affected versions changed · Red Hat
  6. 2026-10-27 Affected versions changed · Red Hat
  7. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  8. 2026-10-30 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  9. 2026-10-30 Affected versions changed · Red Hat

References

Other 6

  • TI-2026-36065 Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser CVSS 3.1HIGH 8.6
  • TI-2026-17325 AdonisJS Path Traversal in Multipart File Handling CVSS 4.0CRITICAL 9.2
  • TI-2026-18330 Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State CVSS 4.0HIGH 8.2
  • TI-2026-20829 Uncontrolled resource consumption in adonisjs core CVSS 3.1HIGH 7.5
  • TI-2026-20822 AdonisJS multipart body parsing has Prototype Pollution issue CVSS 3.1HIGH 7.2
  • TI-2021-06134 Cross-site scripting (XSS) in edge.js CVSS 3.1MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences