Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-104150 (GCVE-0-2026-104150)

Vulnerability from nvd – Published: 2026-10-15 18:42 – Updated: 2026-10-15 19:52

Title

AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 19:52 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/http-server/security/…	x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/86…	x_refsource_MISC
https://github.com/adonisjs/http-server/commit/d8…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	http-server	Affected: < 8.2.2 Affected: >= 9.0.0, < 9.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104150",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T19:52:15.785825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T19:52:22.221Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.2.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:43:27.867Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-524c-h47v-m3h8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-524c-h47v-m3h8"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/d8c749aa9f66d5d214bad1cad727264aef4be727",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/d8c749aa9f66d5d214bad1cad727264aef4be727"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.2"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v9.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v9.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-524c-h47v-m3h8",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104150",
    "datePublished": "2026-10-15T18:42:54.929Z",
    "dateReserved": "2026-10-01T18:47:30.997Z",
    "dateUpdated": "2026-10-15T19:52:22.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107718 (GCVE-0-2026-107718)

Vulnerability from nvd – Published: 2026-10-08 21:39 – Updated: 2026-10-14 01:24

Title

AdonisJS: Unencoded route parameters can produce open redirects

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 01:24 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/http-server/security/…	x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/45…	x_refsource_MISC
https://github.com/adonisjs/http-server/commit/ab…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	http-server	Affected: < 8.2.3 Affected: >= 9.0.0, < 9.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107718",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T01:24:04.422529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T01:24:14.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T21:39:54.474Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-2m6q-8v3h-jqww",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS: Unencoded route parameters can produce open redirects"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107718",
    "datePublished": "2026-10-08T21:39:54.474Z",
    "dateReserved": "2026-10-08T17:21:52.975Z",
    "dateUpdated": "2026-10-14T01:24:14.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-61526 (GCVE-0-2026-61526)

Vulnerability from nvd – Published: 2026-07-30 20:55 – Updated: 2026-07-31 19:20

Title

AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-31 19:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/http-server/security/…	x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/5d…	x_refsource_MISC
https://github.com/adonisjs/http-server/commit/71…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	http-server	Affected: >= 8.0.0-next.0, < 8.2.1 Affected: >= 9.0.0, < 9.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61526",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T19:20:24.928162Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T19:20:48.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-next.0, \u003c 8.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the  error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T20:55:43.406Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cwm9-gfhc-46f6",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61526",
    "datePublished": "2026-07-30T20:55:43.406Z",
    "dateReserved": "2026-07-10T16:27:03.092Z",
    "dateUpdated": "2026-07-31T19:20:48.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48795 (GCVE-0-2026-48795)

Vulnerability from nvd – Published: 2026-07-15 21:23 – Updated: 2026-07-16 18:49

Title

Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser

Summary

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 18:49 UTC

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/core/security/advisor…	x_refsource_CONFIRM
https://github.com/adonisjs/bodyparser/commit/8a8…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/commit/aa9…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	core	Affected: >= 10.1.3, < 10.1.5 Affected: >= 11.0.0-next.9, < 11.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48795",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T18:49:46.350453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T18:49:54.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.1.3, \u003c 10.1.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0-next.9, \u003c 11.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T21:23:14.393Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/core/security/advisories/GHSA-qcm7-3vpr-hj5h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/core/security/advisories/GHSA-qcm7-3vpr-hj5h"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/commit/8a85eb0c2061b0caca10faedbfc2cf24b56cf9f6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/commit/8a85eb0c2061b0caca10faedbfc2cf24b56cf9f6"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/commit/aa96908f7b3f64c19e15d2d2d916b69137bdf469",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/commit/aa96908f7b3f64c19e15d2d2d916b69137bdf469"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.5"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-qcm7-3vpr-hj5h",
        "discovery": "UNKNOWN"
      },
      "title": "Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48795",
    "datePublished": "2026-07-15T21:23:14.393Z",
    "dateReserved": "2026-05-22T20:18:20.366Z",
    "dateUpdated": "2026-07-16T18:49:54.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40255 (GCVE-0-2026-40255)

Vulnerability from nvd – Published: 2026-04-16 22:25 – Updated: 2026-04-17 18:43

Title

@adonisjs/http-server has an Open Redirect vulnerability

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-17 18:42 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/adonisjs/http-server/security/…	x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/20…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
adonisjs	http-server	Affected: >= 8.0.0-next.0, < 8.2.0 Affected: < 7.8.1
adonisjs	http-core	Affected: < 7.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40255",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-17T18:42:55.549238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-17T18:43:10.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-next.0, \u003c 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003c 7.8.1"
            }
          ]
        },
        {
          "product": "http-core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect(\u0027back\u0027). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T22:25:38.155Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6qvv-pj99-48qm",
        "discovery": "UNKNOWN"
      },
      "title": "@adonisjs/http-server has an Open Redirect vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40255",
    "datePublished": "2026-04-16T22:25:38.155Z",
    "dateReserved": "2026-04-10T17:31:45.787Z",
    "dateUpdated": "2026-04-17T18:43:10.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25762 (GCVE-0-2026-25762)

Vulnerability from nvd – Published: 2026-02-06 22:48 – Updated: 2026-02-09 15:26

Title

AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection

Summary

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-09 15:21 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/adonisjs/core/security/advisor…	x_refsource_CONFIRM
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	core	Affected: < 10.1.3 Affected: < 11.0.0-next.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-09T15:21:47.910215Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-09T15:26:05.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.1.3"
            },
            {
              "status": "affected",
              "version": "\u003c 11.0.0-next.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-06T22:48:55.471Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.3"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9"
        }
      ],
      "source": {
        "advisory": "GHSA-xx9g-fh25-4q64",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25762",
    "datePublished": "2026-02-06T22:48:55.471Z",
    "dateReserved": "2026-02-05T18:35:52.358Z",
    "dateUpdated": "2026-02-09T15:26:05.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25754 (GCVE-0-2026-25754)

Vulnerability from nvd – Published: 2026-02-06 22:48 – Updated: 2026-02-09 15:26

Title

AdonisJS multipart body parsing has Prototype Pollution issue

Summary

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-09 15:21 UTC

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/adonisjs/core/security/advisor…	x_refsource_CONFIRM
https://github.com/adonisjs/bodyparser/commit/40e…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	core	Affected: < 10.1.3 Affected: < 11.0.0-next.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25754",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-09T15:21:49.378875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-09T15:26:12.060Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.1.3"
            },
            {
              "status": "affected",
              "version": "\u003c 11.0.0-next.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-06T22:48:38.668Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/commit/40e1c71f958cffb74f6b91bed6630dca979062ed",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/commit/40e1c71f958cffb74f6b91bed6630dca979062ed"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9"
        }
      ],
      "source": {
        "advisory": "GHSA-f5x2-vj4h-vg4c",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS multipart body parsing has Prototype Pollution issue"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25754",
    "datePublished": "2026-02-06T22:48:38.668Z",
    "dateReserved": "2026-02-05T18:35:52.357Z",
    "dateUpdated": "2026-02-09T15:26:12.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22814 (GCVE-0-2026-22814)

Vulnerability from nvd – Published: 2026-01-13 19:42 – Updated: 2026-01-14 17:26

Title

Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State

Summary

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-14 17:26 UTC

CWE

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/adonisjs/lucid/security/adviso…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
adonisjs	lucid	Affected: < 21.8.2 Affected: >= 22.0.0-next.0, < 22.0.0-next.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T17:26:06.187349Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T17:26:12.012Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lucid",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 21.8.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-next.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-13T19:42:14.346Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/lucid/security/advisories/GHSA-g5gc-h5hp-555f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/lucid/security/advisories/GHSA-g5gc-h5hp-555f"
        }
      ],
      "source": {
        "advisory": "GHSA-g5gc-h5hp-555f",
        "discovery": "UNKNOWN"
      },
      "title": "Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22814",
    "datePublished": "2026-01-13T19:42:14.346Z",
    "dateReserved": "2026-01-09T22:50:10.288Z",
    "dateUpdated": "2026-01-14T17:26:12.012Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-21440 (GCVE-0-2026-21440)

Vulnerability from nvd – Published: 2026-01-02 19:02 – Updated: 2026-01-05 20:37

Title

AdonisJS Path Traversal in Multipart File Handling

Summary

AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-05 20:31 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/core/security/advisor…	x_refsource_CONFIRM
https://github.com/adonisjs/bodyparser/commit/143…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/commit/679…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	core	Affected: < 10.1.2 Affected: >= 11.0.0-next.0, < 11.0.0-next.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21440",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-05T20:31:29.643534Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-05T20:37:47.577Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.1.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0-next.0, \u003c 11.0.0-next.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T19:02:18.393Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/core/security/advisories/GHSA-gvq6-hvvp-h34h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/core/security/advisories/GHSA-gvq6-hvvp-h34h"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/commit/6795c0e3fa824ae275bbd992aae60609e96f0f03",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/commit/6795c0e3fa824ae275bbd992aae60609e96f0f03"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.2"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.6"
        }
      ],
      "source": {
        "advisory": "GHSA-gvq6-hvvp-h34h",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS Path Traversal in Multipart File Handling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-21440",
    "datePublished": "2026-01-02T19:02:18.393Z",
    "dateReserved": "2025-12-29T03:00:29.276Z",
    "dateUpdated": "2026-01-05T20:37:47.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-23443 (GCVE-0-2021-23443)

Vulnerability from nvd – Published: 2021-09-21 16:50 – Updated: 2024-09-16 22:09

Title

Cross-site Scripting (XSS)

Summary

This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE

Cross-site Scripting (XSS)

Assigner

snyk CNA under the mitre root

CNA scorecard C 60/100 over 15 records in the last 180 days details

References

2 references

URL	Tags
https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556	x_refsource_MISC
https://github.com/edge-js/edge/commit/fa2c7fde86…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	edge.js	Affected: unspecified , < 5.3.2 (custom)

Date Public

2021-09-21 00:00

Credits

Alessio Della Libera of Snyk Research Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:05:56.040Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "edge.js",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "5.3.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alessio Della Libera of Snyk Research Team"
        }
      ],
      "datePublic": "2021-09-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-21T16:50:10.000Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21"
        }
      ],
      "title": "Cross-site Scripting (XSS)",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2021-09-21T16:49:33.980993Z",
          "ID": "CVE-2021-23443",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "edge.js",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Alessio Della Libera of Snyk Research Team"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556"
            },
            {
              "name": "https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21",
              "refsource": "MISC",
              "url": "https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2021-23443",
    "datePublished": "2021-09-21T16:50:10.641Z",
    "dateReserved": "2021-01-08T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:09:33.398Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-104150 (GCVE-0-2026-104150)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:42 – Updated: 2026-10-15 19:52

Title

AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 19:52 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/http-server/security/…	x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/86…	x_refsource_MISC
https://github.com/adonisjs/http-server/commit/d8…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	http-server	Affected: < 8.2.2 Affected: >= 9.0.0, < 9.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104150",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T19:52:15.785825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T19:52:22.221Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.2.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:43:27.867Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-524c-h47v-m3h8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-524c-h47v-m3h8"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/d8c749aa9f66d5d214bad1cad727264aef4be727",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/d8c749aa9f66d5d214bad1cad727264aef4be727"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.2"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v9.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v9.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-524c-h47v-m3h8",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104150",
    "datePublished": "2026-10-15T18:42:54.929Z",
    "dateReserved": "2026-10-01T18:47:30.997Z",
    "dateUpdated": "2026-10-15T19:52:22.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107718 (GCVE-0-2026-107718)

Vulnerability from cvelistv5 – Published: 2026-10-08 21:39 – Updated: 2026-10-14 01:24

Title

AdonisJS: Unencoded route parameters can produce open redirects

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 01:24 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/http-server/security/…	x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/45…	x_refsource_MISC
https://github.com/adonisjs/http-server/commit/ab…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	http-server	Affected: < 8.2.3 Affected: >= 9.0.0, < 9.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107718",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T01:24:04.422529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T01:24:14.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T21:39:54.474Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-2m6q-8v3h-jqww",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS: Unencoded route parameters can produce open redirects"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107718",
    "datePublished": "2026-10-08T21:39:54.474Z",
    "dateReserved": "2026-10-08T17:21:52.975Z",
    "dateUpdated": "2026-10-14T01:24:14.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-61526 (GCVE-0-2026-61526)

Vulnerability from cvelistv5 – Published: 2026-07-30 20:55 – Updated: 2026-07-31 19:20

Title

AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-31 19:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/http-server/security/…	x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/5d…	x_refsource_MISC
https://github.com/adonisjs/http-server/commit/71…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	http-server	Affected: >= 8.0.0-next.0, < 8.2.1 Affected: >= 9.0.0, < 9.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61526",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T19:20:24.928162Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T19:20:48.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-next.0, \u003c 8.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the  error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T20:55:43.406Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.1"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v9.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cwm9-gfhc-46f6",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61526",
    "datePublished": "2026-07-30T20:55:43.406Z",
    "dateReserved": "2026-07-10T16:27:03.092Z",
    "dateUpdated": "2026-07-31T19:20:48.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48795 (GCVE-0-2026-48795)

Vulnerability from cvelistv5 – Published: 2026-07-15 21:23 – Updated: 2026-07-16 18:49

Title

Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser

Summary

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 18:49 UTC

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/core/security/advisor…	x_refsource_CONFIRM
https://github.com/adonisjs/bodyparser/commit/8a8…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/commit/aa9…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	core	Affected: >= 10.1.3, < 10.1.5 Affected: >= 11.0.0-next.9, < 11.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48795",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T18:49:46.350453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T18:49:54.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.1.3, \u003c 10.1.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0-next.9, \u003c 11.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T21:23:14.393Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/core/security/advisories/GHSA-qcm7-3vpr-hj5h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/core/security/advisories/GHSA-qcm7-3vpr-hj5h"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/commit/8a85eb0c2061b0caca10faedbfc2cf24b56cf9f6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/commit/8a85eb0c2061b0caca10faedbfc2cf24b56cf9f6"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/commit/aa96908f7b3f64c19e15d2d2d916b69137bdf469",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/commit/aa96908f7b3f64c19e15d2d2d916b69137bdf469"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.5"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-qcm7-3vpr-hj5h",
        "discovery": "UNKNOWN"
      },
      "title": "Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48795",
    "datePublished": "2026-07-15T21:23:14.393Z",
    "dateReserved": "2026-05-22T20:18:20.366Z",
    "dateUpdated": "2026-07-16T18:49:54.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40255 (GCVE-0-2026-40255)

Vulnerability from cvelistv5 – Published: 2026-04-16 22:25 – Updated: 2026-04-17 18:43

Title

@adonisjs/http-server has an Open Redirect vulnerability

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-17 18:42 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/adonisjs/http-server/security/…	x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/20…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
adonisjs	http-server	Affected: >= 8.0.0-next.0, < 8.2.0 Affected: < 7.8.1
adonisjs	http-core	Affected: < 7.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40255",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-17T18:42:55.549238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-17T18:43:10.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-next.0, \u003c 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003c 7.8.1"
            }
          ]
        },
        {
          "product": "http-core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect(\u0027back\u0027). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T22:25:38.155Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6qvv-pj99-48qm",
        "discovery": "UNKNOWN"
      },
      "title": "@adonisjs/http-server has an Open Redirect vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40255",
    "datePublished": "2026-04-16T22:25:38.155Z",
    "dateReserved": "2026-04-10T17:31:45.787Z",
    "dateUpdated": "2026-04-17T18:43:10.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25762 (GCVE-0-2026-25762)

Vulnerability from cvelistv5 – Published: 2026-02-06 22:48 – Updated: 2026-02-09 15:26

Title

AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection

Summary

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-09 15:21 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/adonisjs/core/security/advisor…	x_refsource_CONFIRM
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	core	Affected: < 10.1.3 Affected: < 11.0.0-next.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-09T15:21:47.910215Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-09T15:26:05.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.1.3"
            },
            {
              "status": "affected",
              "version": "\u003c 11.0.0-next.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in memory while attempting to detect file types, potentially leading to excessive memory consumption and process termination. This issue has been patched in versions 10.1.3 and 11.0.0-next.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-06T22:48:55.471Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/core/security/advisories/GHSA-xx9g-fh25-4q64"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.3"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9"
        }
      ],
      "source": {
        "advisory": "GHSA-xx9g-fh25-4q64",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25762",
    "datePublished": "2026-02-06T22:48:55.471Z",
    "dateReserved": "2026-02-05T18:35:52.358Z",
    "dateUpdated": "2026-02-09T15:26:05.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25754 (GCVE-0-2026-25754)

Vulnerability from cvelistv5 – Published: 2026-02-06 22:48 – Updated: 2026-02-09 15:26

Title

AdonisJS multipart body parsing has Prototype Pollution issue

Summary

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-09 15:21 UTC

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/adonisjs/core/security/advisor…	x_refsource_CONFIRM
https://github.com/adonisjs/bodyparser/commit/40e…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	core	Affected: < 10.1.3 Affected: < 11.0.0-next.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25754",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-09T15:21:49.378875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-09T15:26:12.060Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.1.3"
            },
            {
              "status": "affected",
              "version": "\u003c 11.0.0-next.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This issue has been patched in versions 10.1.3 and 11.0.0-next.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-06T22:48:38.668Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/commit/40e1c71f958cffb74f6b91bed6630dca979062ed",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/commit/40e1c71f958cffb74f6b91bed6630dca979062ed"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.9"
        }
      ],
      "source": {
        "advisory": "GHSA-f5x2-vj4h-vg4c",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS multipart body parsing has Prototype Pollution issue"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25754",
    "datePublished": "2026-02-06T22:48:38.668Z",
    "dateReserved": "2026-02-05T18:35:52.357Z",
    "dateUpdated": "2026-02-09T15:26:12.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22814 (GCVE-0-2026-22814)

Vulnerability from cvelistv5 – Published: 2026-01-13 19:42 – Updated: 2026-01-14 17:26

Title

Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State

Summary

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-14 17:26 UTC

CWE

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/adonisjs/lucid/security/adviso…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
adonisjs	lucid	Affected: < 21.8.2 Affected: >= 22.0.0-next.0, < 22.0.0-next.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T17:26:06.187349Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T17:26:12.012Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lucid",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 21.8.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0-next.0, \u003c 22.0.0-next.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-13T19:42:14.346Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/lucid/security/advisories/GHSA-g5gc-h5hp-555f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/lucid/security/advisories/GHSA-g5gc-h5hp-555f"
        }
      ],
      "source": {
        "advisory": "GHSA-g5gc-h5hp-555f",
        "discovery": "UNKNOWN"
      },
      "title": "Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22814",
    "datePublished": "2026-01-13T19:42:14.346Z",
    "dateReserved": "2026-01-09T22:50:10.288Z",
    "dateUpdated": "2026-01-14T17:26:12.012Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-21440 (GCVE-0-2026-21440)

Vulnerability from cvelistv5 – Published: 2026-01-02 19:02 – Updated: 2026-01-05 20:37

Title

AdonisJS Path Traversal in Multipart File Handling

Summary

AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-05 20:31 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/core/security/advisor…	x_refsource_CONFIRM
https://github.com/adonisjs/bodyparser/commit/143…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/commit/679…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC
https://github.com/adonisjs/bodyparser/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
adonisjs	core	Affected: < 10.1.2 Affected: >= 11.0.0-next.0, < 11.0.0-next.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21440",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-05T20:31:29.643534Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-05T20:37:47.577Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.1.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0-next.0, \u003c 11.0.0-next.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T19:02:18.393Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/core/security/advisories/GHSA-gvq6-hvvp-h34h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/core/security/advisories/GHSA-gvq6-hvvp-h34h"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/commit/6795c0e3fa824ae275bbd992aae60609e96f0f03",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/commit/6795c0e3fa824ae275bbd992aae60609e96f0f03"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v10.1.2"
        },
        {
          "name": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/bodyparser/releases/tag/v11.0.0-next.6"
        }
      ],
      "source": {
        "advisory": "GHSA-gvq6-hvvp-h34h",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS Path Traversal in Multipart File Handling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-21440",
    "datePublished": "2026-01-02T19:02:18.393Z",
    "dateReserved": "2025-12-29T03:00:29.276Z",
    "dateUpdated": "2026-01-05T20:37:47.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-23443 (GCVE-0-2021-23443)

Vulnerability from cvelistv5 – Published: 2021-09-21 16:50 – Updated: 2024-09-16 22:09

Title

Cross-site Scripting (XSS)

Summary

This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE

Cross-site Scripting (XSS)

Assigner

snyk CNA under the mitre root

CNA scorecard C 60/100 over 15 records in the last 180 days details

References

2 references

URL	Tags
https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556	x_refsource_MISC
https://github.com/edge-js/edge/commit/fa2c7fde86…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	edge.js	Affected: unspecified , < 5.3.2 (custom)

Date Public

2021-09-21 00:00

Credits

Alessio Della Libera of Snyk Research Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:05:56.040Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "edge.js",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "5.3.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alessio Della Libera of Snyk Research Team"
        }
      ],
      "datePublic": "2021-09-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-21T16:50:10.000Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21"
        }
      ],
      "title": "Cross-site Scripting (XSS)",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2021-09-21T16:49:33.980993Z",
          "ID": "CVE-2021-23443",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "edge.js",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Alessio Della Libera of Snyk Research Team"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556"
            },
            {
              "name": "https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21",
              "refsource": "MISC",
              "url": "https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2021-23443",
    "datePublished": "2021-09-21T16:50:10.641Z",
    "dateReserved": "2021-01-08T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:09:33.398Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

20 vulnerabilities by adonisjs

CVE-2026-104150 (GCVE-0-2026-104150)

CVE-2026-107718 (GCVE-0-2026-107718)

CVE-2026-61526 (GCVE-0-2026-61526)

CVE-2026-48795 (GCVE-0-2026-48795)

CVE-2026-40255 (GCVE-0-2026-40255)

CVE-2026-25762 (GCVE-0-2026-25762)

CVE-2026-25754 (GCVE-0-2026-25754)

CVE-2026-22814 (GCVE-0-2026-22814)

CVE-2026-21440 (GCVE-0-2026-21440)

CVE-2021-23443 (GCVE-0-2021-23443)

CVE-2026-104150 (GCVE-0-2026-104150)

CVE-2026-107718 (GCVE-0-2026-107718)

CVE-2026-61526 (GCVE-0-2026-61526)

CVE-2026-48795 (GCVE-0-2026-48795)

CVE-2026-40255 (GCVE-0-2026-40255)

CVE-2026-25762 (GCVE-0-2026-25762)

CVE-2026-25754 (GCVE-0-2026-25754)

CVE-2026-22814 (GCVE-0-2026-22814)

CVE-2026-21440 (GCVE-0-2026-21440)

CVE-2021-23443 (GCVE-0-2021-23443)