CVE-2026-61526 in http-server
Summary
by MITRE • 07/31/2026
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability identified in AdonisJS HTTP Server represents a critical cross-site scripting flaw that arises from improper input sanitization during error handling processes. This security weakness affects versions ranging from 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, where the framework's default exception handling mechanism fails to properly escape user-controllable data before rendering it within HTML responses. The flaw specifically manifests when a missing-route URL is crafted with malicious JavaScript code within the error.message parameter, creating a persistent cross-site scripting vector that can be exploited through victim interaction with the malformed URL.
The technical implementation of this vulnerability stems from the framework's default HTML exception renderer which directly interpolates the error.message variable into HTML template content without any sanitization or escaping mechanisms. When debug mode is disabled and no custom error handlers are configured, the system falls back to its default rendering process that treats the error.message as trusted input for HTML generation. This behavior creates a classic XSS vulnerability pattern where attacker-controlled data flows directly into executable JavaScript contexts within the victim's browser environment. The CWE-79 classification applies here as the framework fails to properly escape output data, allowing malicious scripts to be executed in the context of the victim's session.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers to perform session hijacking, credential theft, and other malicious activities through social engineering techniques. Victims who visit crafted URLs containing malicious payloads can unknowingly execute JavaScript code that may steal cookies, redirect to malicious sites, or perform actions on behalf of the authenticated user. The attack vector is particularly dangerous because it requires no authentication or privileged access from the attacker, making it a server-side vulnerability that can be exploited through user interaction with specially crafted URLs. This weakness aligns with ATT&CK technique T1203 which involves exploiting web applications to perform malicious activities through compromised user sessions.
Mitigation strategies for this vulnerability require immediate implementation of framework updates to versions 8.2.1 or 9.1.0 where the XSS protection has been properly implemented. Organizations should also consider implementing additional defensive measures such as content security policy headers to limit script execution capabilities in the browser context, and regular monitoring of application logs for suspicious URL patterns that might indicate attempted exploitation. The fix addresses the root cause by ensuring that error messages are properly escaped before HTML interpolation, preventing malicious JavaScript from being executed within victim browsers. Security teams should conduct comprehensive vulnerability assessments to identify any custom error handlers that may still be vulnerable to similar issues and ensure all application components properly sanitize user inputs before processing.