Search
Find a vulnerability
Search criteria
4 vulnerabilities found for http-server by adonisjs
CVE-2026-61526 (GCVE-0-2026-61526)
Vulnerability from nvd – Published: 2026-07-30 20:55 – Updated: 2026-07-30 20:55
VLAI
EPSS
VEX
Title
AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler
Summary
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/adonisjs/http-server/security/… | x_refsource_CONFIRM |
| https://github.com/adonisjs/http-server/commit/5d… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/commit/71… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/releases/… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| adonisjs | http-server |
Affected:
>= 8.0.0-next.0, < 8.2.1
Affected: >= 9.0.0, < 9.1.0 |
{
"containers": {
"cna": {
"affected": [
{
"product": "http-server",
"vendor": "adonisjs",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0-next.0, \u003c 8.2.1"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T20:55:43.406Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6"
},
{
"name": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87"
},
{
"name": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3"
},
{
"name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1"
},
{
"name": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0"
}
],
"source": {
"advisory": "GHSA-cwm9-gfhc-46f6",
"discovery": "UNKNOWN"
},
"title": "AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61526",
"datePublished": "2026-07-30T20:55:43.406Z",
"dateReserved": "2026-07-10T16:27:03.092Z",
"dateUpdated": "2026-07-30T20:55:43.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40255 (GCVE-0-2026-40255)
Vulnerability from nvd – Published: 2026-04-16 22:25 – Updated: 2026-04-17 18:43
VLAI
EPSS
VEX
Title
@adonisjs/http-server has an Open Redirect vulnerability
Summary
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/adonisjs/http-server/security/… | x_refsource_CONFIRM |
| https://github.com/adonisjs/http-server/commit/20… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/releases/… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/releases/… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| adonisjs | http-server |
Affected:
>= 8.0.0-next.0, < 8.2.0
Affected: < 7.8.1 |
|
| adonisjs | http-core |
Affected:
< 7.4.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-17T18:42:55.549238Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-17T18:43:10.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "http-server",
"vendor": "adonisjs",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0-next.0, \u003c 8.2.0"
},
{
"status": "affected",
"version": "\u003c 7.8.1"
}
]
},
{
"product": "http-core",
"vendor": "adonisjs",
"versions": [
{
"status": "affected",
"version": "\u003c 7.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect(\u0027back\u0027). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T22:25:38.155Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
},
{
"name": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
},
{
"name": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
},
{
"name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
}
],
"source": {
"advisory": "GHSA-6qvv-pj99-48qm",
"discovery": "UNKNOWN"
},
"title": "@adonisjs/http-server has an Open Redirect vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-40255",
"datePublished": "2026-04-16T22:25:38.155Z",
"dateReserved": "2026-04-10T17:31:45.787Z",
"dateUpdated": "2026-04-17T18:43:10.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61526 (GCVE-0-2026-61526)
Vulnerability from cvelistv5 – Published: 2026-07-30 20:55 – Updated: 2026-07-30 20:55
VLAI
EPSS
VEX
Title
AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler
Summary
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/adonisjs/http-server/security/… | x_refsource_CONFIRM |
| https://github.com/adonisjs/http-server/commit/5d… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/commit/71… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/releases/… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| adonisjs | http-server |
Affected:
>= 8.0.0-next.0, < 8.2.1
Affected: >= 9.0.0, < 9.1.0 |
{
"containers": {
"cna": {
"affected": [
{
"product": "http-server",
"vendor": "adonisjs",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0-next.0, \u003c 8.2.1"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T20:55:43.406Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6"
},
{
"name": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87"
},
{
"name": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3"
},
{
"name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1"
},
{
"name": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0"
}
],
"source": {
"advisory": "GHSA-cwm9-gfhc-46f6",
"discovery": "UNKNOWN"
},
"title": "AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61526",
"datePublished": "2026-07-30T20:55:43.406Z",
"dateReserved": "2026-07-10T16:27:03.092Z",
"dateUpdated": "2026-07-30T20:55:43.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40255 (GCVE-0-2026-40255)
Vulnerability from cvelistv5 – Published: 2026-04-16 22:25 – Updated: 2026-04-17 18:43
VLAI
EPSS
VEX
Title
@adonisjs/http-server has an Open Redirect vulnerability
Summary
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/adonisjs/http-server/security/… | x_refsource_CONFIRM |
| https://github.com/adonisjs/http-server/commit/20… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/releases/… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/releases/… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| adonisjs | http-server |
Affected:
>= 8.0.0-next.0, < 8.2.0
Affected: < 7.8.1 |
|
| adonisjs | http-core |
Affected:
< 7.4.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-17T18:42:55.549238Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-17T18:43:10.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "http-server",
"vendor": "adonisjs",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0-next.0, \u003c 8.2.0"
},
{
"status": "affected",
"version": "\u003c 7.8.1"
}
]
},
{
"product": "http-core",
"vendor": "adonisjs",
"versions": [
{
"status": "affected",
"version": "\u003c 7.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect(\u0027back\u0027). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T22:25:38.155Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
},
{
"name": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
},
{
"name": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
},
{
"name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
}
],
"source": {
"advisory": "GHSA-6qvv-pj99-48qm",
"discovery": "UNKNOWN"
},
"title": "@adonisjs/http-server has an Open Redirect vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-40255",
"datePublished": "2026-04-16T22:25:38.155Z",
"dateReserved": "2026-04-10T17:31:45.787Z",
"dateUpdated": "2026-04-17T18:43:10.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}