Vulnerabilities

TI-2026-74653 CVE-2026-104150 · GHSA-524c-h47v-m3h8

Regex backtracking in AdonisJS HTTP Server slug matcher exhausts CPU

MEDIUM 44

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00367 Published 2026-10-15 Partial fix · 8.2.2, 9.1.1 CWE-1333

TI-2026-69677 CVE-2026-107718 · GHSA-2m6q-8v3h-jqww

Open redirect in AdonisJS HTTP Server through route parameters

LOW 27

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00278 Published 2026-10-08 Partial fix · 8.2.3, 9.3.0 CWE-601

TI-2026-44097 CVE-2026-61526

AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

LOW 27

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00338 Published 2026-07-30 Fixed in 8.2.1, 9.1.0 CWE-79

TI-2026-36065 CVE-2026-48795 · GHSA-qcm7-3vpr-hj5h

Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser

MEDIUM 44

AdonisJS is a TypeScript-first web framework.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00547 Published 2026-07-15 Fixed in 10.1.5, 11.0.3 CWE-1321

TI-2026-29049 CVE-2026-40255 · GHSA-6qvv-pj99-48qm

@adonisjs/http-server has an Open Redirect vulnerability

LOW 27

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00248 Published 2026-04-16 Fixed in 8.2.0, 7.8.1 +2 CWE-601

TI-2026-20829 CVE-2026-25762 · GHSA-xx9g-fh25-4q64

Uncontrolled resource consumption in adonisjs core

MEDIUM 40

AdonisJS is a TypeScript-first web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00534 Published 2026-02-06 Fixed in 10.1.3, 11.0.0-next.9 CWE-400

TI-2026-20822 CVE-2026-25754 · GHSA-f5x2-vj4h-vg4c

AdonisJS multipart body parsing has Prototype Pollution issue

LOW 38

AdonisJS is a TypeScript-first web framework.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00417 Published 2026-02-06 Fixed in 10.1.3, 11.0.0-next.9 CWE-1321

TI-2026-18330 CVE-2026-22814 · GHSA-g5gc-h5hp-555f

Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State

MEDIUM 42

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00536 Published 2026-01-13 Fixed in 21.8.2, 22.0.0-next.6 CWE-915

TI-2026-17325 CVE-2026-21440 · GHSA-gvq6-hvvp-h34h

AdonisJS Path Traversal in Multipart File Handling

MEDIUM 44

AdonisJS is a TypeScript-first web framework.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01034 Published 2026-01-02 Fixed in 10.1.2, 11.0.0-next.6 CWE-22

TI-2021-06134 CVE-2021-23443 · GHSA-55r9-7mf8-m382

Cross-site scripting (XSS) in edge.js

LOW 29

This affects the package edge.js before 5.3.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00906 Published 2021-09-21 Fixed in 5.3.2 CWE-843

Vulnerabilities

Filters