CVE-2026-107718 in http-server
Summary
by MITRE • 10/09/2026
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The AdonisJS HTTP Server package serves as the core component for managing incoming HTTP requests within the AdonisJS web framework. A critical security vulnerability exists in versions prior to 8.2.3 and 9.3.0, specifically affecting the shared createURL helper function utilized by Router.makeUrl() and Response.redirect().toRoute(). This flaw stems from a failure to properly encode route parameter values when constructing URLs. Specifically, dynamic path segments that contain user-supplied data are inserted into the resulting URL string without applying encodeURIComponent or equivalent sanitization measures. This oversight allows special characters present in the input parameters to be interpreted literally by the browser rather than being escaped as part of the path component.
The operational impact of this vulnerability is significant when an application places attacker-controlled data into a dynamic first path segment and subsequently uses that generated URL as a redirect destination. If the injected parameter value begins with a forward slash, it disrupts the expected relative URL structure. Instead of treating the remainder of the string as a path within the current domain, the browser interprets the sequence starting from the second character onward as an absolute scheme-relative URL. This effectively allows an attacker to override the intended host and redirect users to any external domain they control. While wildcard parameters are also susceptible due to the same missing encoding logic, APIs that intentionally accept complete, pre-formed redirect URLs remain unaffected by this specific flaw because they do not rely on the automatic parameter injection mechanism of the createURL helper.
This vulnerability is classified under CWE-601: URL Redirection to Untrusted Site (Open Redirect). It aligns with MITRE ATT&CK technique T1566.002, which covers Spearphishing Link attacks where an attacker uses a malicious link to trick users into visiting a compromised site. The primary risk involves phishing campaigns and the abuse of authentication flows. By redirecting victims from a trusted AdonisJS application to a malicious domain that mimics legitimate login pages or OAuth providers, attackers can harvest credentials, session tokens, or other sensitive information. This undermines user trust in the original service and compromises the integrity of identity verification processes dependent on secure redirection practices.
To mitigate this risk, organizations must upgrade their AdonisJS HTTP Server package to version 8.2.3 or later for the v8 branch, or version 9.3.0 or later for the v9 branch. These releases include patches that ensure route parameter values are properly encoded before being inserted into URLs, thereby preventing the interpretation of injected slashes as scheme delimiters. In addition to upgrading dependencies, developers should implement defense-in-depth strategies by validating and sanitizing all user inputs used in dynamic routing contexts. It is also advisable to review application logic for any instances where redirect destinations are constructed from untrusted sources, ensuring that only whitelisted domains or strictly validated paths are permitted as targets for redirection operations.