Search criteria

2 vulnerabilities found for http-server by adonisjs

CVE-2026-40255 (GCVE-0-2026-40255)

Vulnerability from nvd – Published: 2026-04-16 22:25 – Updated: 2026-04-17 18:43
VLAI
Title
@adonisjs/http-server has an Open Redirect vulnerability
Summary
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.
Severity
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
Impacted products
Vendor Product Version
adonisjs http-server Affected: >= 8.0.0-next.0, < 8.2.0
Affected: < 7.8.1
Create a notification for this product.
adonisjs http-core Affected: < 7.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40255",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-17T18:42:55.549238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-17T18:43:10.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-next.0, \u003c 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003c 7.8.1"
            }
          ]
        },
        {
          "product": "http-core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect(\u0027back\u0027). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T22:25:38.155Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6qvv-pj99-48qm",
        "discovery": "UNKNOWN"
      },
      "title": "@adonisjs/http-server has an Open Redirect vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40255",
    "datePublished": "2026-04-16T22:25:38.155Z",
    "dateReserved": "2026-04-10T17:31:45.787Z",
    "dateUpdated": "2026-04-17T18:43:10.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40255 (GCVE-0-2026-40255)

Vulnerability from cvelistv5 – Published: 2026-04-16 22:25 – Updated: 2026-04-17 18:43
VLAI
Title
@adonisjs/http-server has an Open Redirect vulnerability
Summary
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.
Severity
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
Impacted products
Vendor Product Version
adonisjs http-server Affected: >= 8.0.0-next.0, < 8.2.0
Affected: < 7.8.1
Create a notification for this product.
adonisjs http-core Affected: < 7.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40255",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-17T18:42:55.549238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-17T18:43:10.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0-next.0, \u003c 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003c 7.8.1"
            }
          ]
        },
        {
          "product": "http-core",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect(\u0027back\u0027). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T22:25:38.155Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v7.8.1"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6qvv-pj99-48qm",
        "discovery": "UNKNOWN"
      },
      "title": "@adonisjs/http-server has an Open Redirect vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40255",
    "datePublished": "2026-04-16T22:25:38.155Z",
    "dateReserved": "2026-04-10T17:31:45.787Z",
    "dateUpdated": "2026-04-17T18:43:10.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}