CVE-2026-104150 in http-server
Summary
by MITRE • 10/15/2026
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The AdonisJS HTTP Server package serves as a critical component for managing incoming HTTP requests within the AdonisJS web framework, handling routing logic that directs traffic to appropriate application handlers. A significant vulnerability exists in versions prior to 8.2.2 and 9.1.1 involving the regular expression engine used by the router.matchers.slug() function. This specific matcher is designed to validate slug-style route parameters, which are commonly used for identifying resources via human-readable strings rather than numeric identifiers. The core technical flaw lies in the structure of the regular expression itself, which contains adjacent greedy repetitions with overlapping character classes. Such patterns are notorious in computer science for causing catastrophic backtracking when processing input that nearly matches but ultimately fails a final assertion condition.
When an attacker crafts a long slug string ending in a character that is rejected by the regex's final check, the engine enters a state of quadratic time complexity relative to the length of the input. This phenomenon, known as ReDoS or Regular Expression Denial of Service, forces the Node.js event loop to spend excessive CPU cycles attempting various combinations of matches before finally failing. Because route matching is executed early in the request lifecycle, this processing occurs before any authentication checks or rate-limiting middleware are invoked. Consequently, an unauthenticated attacker can trigger this resource exhaustion without needing valid credentials, effectively bypassing security controls that would normally mitigate such abuse through access restrictions or throttling mechanisms.
The operational impact of this vulnerability is severe for application availability and performance stability. The excessive CPU consumption caused by the backtracking blocks the single-threaded Node.js event loop, preventing it from processing other concurrent requests. This can lead to a complete stall in service delivery, where unrelated legitimate traffic, including health checks required for load balancers and orchestration systems like Kubernetes, is delayed or dropped entirely. In distributed environments, this may trigger false positive failure signals, leading to unnecessary scaling events or node removals, thereby degrading the overall resilience of the infrastructure hosting the AdonisJS application.
To mitigate this risk, organizations must upgrade the @adonisjs/http-server package to version 8.2.2 or later for v8 branches and version 9.1.1 or later for v9 branches. These updated versions resolve the regex structure issues that allow for catastrophic backtracking. Additionally, developers should review their routing configurations to ensure that any custom route parameters are validated using efficient patterns that avoid nested quantifiers with overlapping character sets. Implementing input length limits on URL segments can also serve as a defensive layer, reducing the window of opportunity for such attacks by limiting the maximum size of inputs processed by the regex engine before they reach deeper application logic.
This vulnerability is classified under CWE-400, which covers Uncontrolled Resource Consumption, specifically highlighting how inefficient algorithmic complexity leads to resource exhaustion. In terms of offensive security frameworks, this aligns with MITRE ATT&CK technique T1496, Host Configuration Hijacking or more broadly within the impact category as Service Exhaustion via Flood or Impairment Process Disruption. The attack vector is classified as Network Accessible (Attack Vector: Network) and requires no authentication (Authentication: None), making it a high-severity threat that can be exploited remotely by any actor with network connectivity to the target service. Immediate patching is essential to restore normal operational performance and prevent potential denial-of-service conditions against production environments relying on these earlier versions of the AdonisJS HTTP server package.