Skip to content
OpenAdvisories

Product · adonisjs

http-server

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-107718

    AdonisJS: Unencoded route parameters can produce open redirects

    AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl(…

    adonisjs http-server @adonisjs/http-server npm
  • Medium 6.1
    CVE-2026-61526

    AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

    AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a cra…

    adonisjs http-server
  • Medium 6.1
    CVE-2026-40255

    @adonisjs/http-server has an Open Redirect vulnerability

    AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads th…

    adonisjs http-server http-core @adonisjs/http-server npm