Vulnerability-Lookup

CVE-2026-40255 (GCVE-0-2026-40255)

Vulnerability from cvelistv5 – Published: 2026-04-16 22:25 – Updated: 2026-04-17 18:43

Title

@adonisjs/http-server has an Open Redirect vulnerability

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-17 18:42 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/adonisjs/http-server/security/…	x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/20…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
adonisjs	http-server	Affected: >= 8.0.0-next.0, < 8.2.0 Affected: < 7.8.1	guessed
adonisjs	http-core	Affected: < 7.4.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40255",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-17T18:42:55.549238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-17T18:43:10.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-next.0, \u003c 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003c 7.8.1"
            }
          ]
        },
        {
          "product": "http-core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect(\u0027back\u0027). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T22:25:38.155Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6qvv-pj99-48qm",
        "discovery": "UNKNOWN"
      },
      "title": "@adonisjs/http-server has an Open Redirect vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40255",
    "datePublished": "2026-04-16T22:25:38.155Z",
    "dateReserved": "2026-04-10T17:31:45.787Z",
    "dateUpdated": "2026-04-17T18:43:10.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40255",
      "date": "2026-11-05",
      "epss": "0.00248",
      "percentile": "0.1618"
    },
    "microsoft_vex": {
      "current_release_date": "2026-04-18T01:01:32.000Z",
      "cve": "CVE-2026-40255",
      "id": "msrc_CVE-2026-40255",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "@adonisjs/http-server has an Open Redirect vulnerability",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-40255.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "http-server",
                "vendor": "adonisjs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 8.0.0-next.0, \u003c 8.2.0"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 7.8.1"
                  }
                ]
              },
              {
                "product": "http-core",
                "vendor": "adonisjs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 7.4.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:adonisjs:http-server:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "77440DDE-F846-4D3F-B8EE-6592F09C6B72",
                    "versionEndExcluding": "7.8.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:adonisjs:http-server:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "4C3C876D-A1A4-4E64-9DB4-FF855A0449D7",
                    "versionEndIncluding": "8.1.3",
                    "versionStartExcluding": "8.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:adonisjs:core:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "587A4DBA-0A27-42AA-9DAE-8FB311B65313",
                    "versionEndIncluding": "7.3.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect(\u0027back\u0027). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core."
          },
          {
            "lang": "es",
            "value": "El Servidor HTTP de AdonisJS es un paquete para manejar solicitudes HTTP en el framework de AdonisJS. En las versiones de @adonisjs/http-server anteriores a la 7.8.1 y de la 8.0.0-next.0 a la 8.1.3, y en las versiones de @adonisjs/core anteriores a la 7.4.0, el m\u00e9todo response.redirect().back() lee el encabezado Referer de la solicitud HTTP entrante y redirige a esa URL sin validar el host. Un atacante que puede influir en el encabezado Referer puede hacer que la aplicaci\u00f3n redirija a los usuarios a un sitio externo malicioso. Esto afecta a todas las aplicaciones de AdonisJS que utilizan response.redirect().back() o response.redirect(\u2019back\u2019). Este problema ha sido solucionado en las versiones 7.8.1 y 8.2.0 y 7.4.0 de @adonisjs/core."
          }
        ],
        "id": "CVE-2026-40255",
        "lastModified": "2026-10-26T00:10:00.150",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-40255",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-17T18:42:55.549238Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-16T23:16:33.267",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-601"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:26:58+00:00",
      "cve": "CVE-2026-40255",
      "id": "CVE-2026-40255",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "@adonisjs/http-server has an Open Redirect vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40255.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-40255",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-17T18:42:55.549238Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-17T18:43:07.185Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "http-server",
              "vendor": "adonisjs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 8.0.0-next.0, \u003c 8.2.0"
                },
                {
                  "status": "affected",
                  "version": "\u003c 7.8.1"
                }
              ]
            },
            {
              "product": "http-core",
              "vendor": "adonisjs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 7.4.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect(\u0027back\u0027). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-601",
                  "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-16T22:25:38.155Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
            },
            {
              "name": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
            },
            {
              "name": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
            },
            {
              "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
            }
          ],
          "source": {
            "advisory": "GHSA-6qvv-pj99-48qm",
            "discovery": "UNKNOWN"
          },
          "title": "@adonisjs/http-server has an Open Redirect vulnerability"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-40255",
        "datePublished": "2026-04-16T22:25:38.155Z",
        "dateReserved": "2026-04-10T17:31:45.787Z",
        "dateUpdated": "2026-04-16T22:25:38.155Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-40255

Vulnerability from fkie_nvd - Published: 2026-04-16 23:16 - Updated: 2026-10-26 00:10

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08	Patch
security-advisories@github.com	https://github.com/adonisjs/http-server/releases/tag/v7.8.1	Release Notes
security-advisories@github.com	https://github.com/adonisjs/http-server/releases/tag/v8.2.0	Release Notes
security-advisories@github.com	https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
adonisjs	http-server	*
adonisjs	http-server	*
adonisjs	core	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-next.0, \u003c 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003c 7.8.1"
            }
          ]
        },
        {
          "product": "http-core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adonisjs:http-server:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "77440DDE-F846-4D3F-B8EE-6592F09C6B72",
              "versionEndExcluding": "7.8.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adonisjs:http-server:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "4C3C876D-A1A4-4E64-9DB4-FF855A0449D7",
              "versionEndIncluding": "8.1.3",
              "versionStartExcluding": "8.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adonisjs:core:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "587A4DBA-0A27-42AA-9DAE-8FB311B65313",
              "versionEndIncluding": "7.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect(\u0027back\u0027). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core."
    },
    {
      "lang": "es",
      "value": "El Servidor HTTP de AdonisJS es un paquete para manejar solicitudes HTTP en el framework de AdonisJS. En las versiones de @adonisjs/http-server anteriores a la 7.8.1 y de la 8.0.0-next.0 a la 8.1.3, y en las versiones de @adonisjs/core anteriores a la 7.4.0, el m\u00e9todo response.redirect().back() lee el encabezado Referer de la solicitud HTTP entrante y redirige a esa URL sin validar el host. Un atacante que puede influir en el encabezado Referer puede hacer que la aplicaci\u00f3n redirija a los usuarios a un sitio externo malicioso. Esto afecta a todas las aplicaciones de AdonisJS que utilizan response.redirect().back() o response.redirect(\u2019back\u2019). Este problema ha sido solucionado en las versiones 7.8.1 y 8.2.0 y 7.4.0 de @adonisjs/core."
    }
  ],
  "id": "CVE-2026-40255",
  "lastModified": "2026-10-26T00:10:00.150",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40255",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-17T18:42:55.549238Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-16T23:16:33.267",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6QVV-PJ99-48QM

Vulnerability from github – Published: 2026-04-14 20:01 – Updated: 2026-04-24 19:56

Summary

@adonisjs/http-server has an Open Redirect vulnerability

Details

Impact

The response.redirect().back() method in @adonisjs/http-server is vulnerable to open redirects. The method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the Referer header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site.

This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back').

The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect').

Patches

This has been fixed in @adonisjs/http-server version 8.2.0. The back() method now validates the Referer header's host against the request's own Host header. Referrers from unrecognized hosts are rejected and the redirect falls back to / (or a developer-provided fallback URL).

Applications that operate across multiple domains can configure additional trusted hosts via the redirect.allowedHosts option in config/app.ts.

Users should upgrade to @adonisjs/http-server@^8.2.0 (or @adonisjs/core@^7.4.0 if using the core meta-package).

Workarounds

If upgrading is not immediately possible, avoid using response.redirect().back() in routes that are reachable by unauthenticated users or from pages that accept external traffic. Instead, redirect to a known safe path explicitly using response.redirect().toPath('/dashboard').

References

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@adonisjs/http-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0-next.0"
            },
            {
              "fixed": "8.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@adonisjs/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@adonisjs/http-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40255"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T20:01:28Z",
    "nvd_published_at": "2026-04-16T23:16:33Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe `response.redirect().back()` method in `@adonisjs/http-server` is vulnerable to open redirects. The method reads the `Referer` header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the `Referer` header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site.\n\nThis affects all AdonisJS applications that use `response.redirect().back()` or `response.redirect(\u0027back\u0027)`.\n\nThe vulnerability is classified as CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027).\n\n### Patches\n\nThis has been fixed in `@adonisjs/http-server` version **8.2.0**. The `back()` method now validates the `Referer` header\u0027s host against the request\u0027s own `Host` header. Referrers from unrecognized hosts are rejected and the redirect falls back to `/` (or a developer-provided fallback URL).\n\nApplications that operate across multiple domains can configure additional trusted hosts via the `redirect.allowedHosts` option in `config/app.ts`.\n\nUsers should upgrade to `@adonisjs/http-server@^8.2.0` (or `@adonisjs/core@^7.4.0` if using the core meta-package).\n\n### Workarounds\n\nIf upgrading is not immediately possible, avoid using `response.redirect().back()` in routes that are reachable by unauthenticated users or from pages that accept external traffic. Instead, redirect to a known safe path explicitly using `response.redirect().toPath(\u0027/dashboard\u0027)`.\n\n### References\n\n- [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)\n- [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)",
  "id": "GHSA-6qvv-pj99-48qm",
  "modified": "2026-04-24T19:56:13Z",
  "published": "2026-04-14T20:01:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40255"
    },
    {
      "type": "WEB",
      "url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/adonisjs/http-server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@adonisjs/http-server has an Open Redirect vulnerability"
}

MSRC_CVE-2026-40255

Vulnerability from csaf_microsoft - Published: 2026-04-02 00:00 - Updated: 2026-04-18 01:01

Summary

@adonisjs/http-server has an Open Redirect vulnerability

Scope

1 vulnerability in this advisory, including CVE-2026-40255.

CVE-2026-40255

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-40255 (GCVE-0-2026-40255)

FKIE_CVE-2026-40255

GHSA-6QVV-PJ99-48QM

Impact

Patches

Workarounds

References

MSRC_CVE-2026-40255

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour