CVE-2026-107718: AdonisJS HTTP Server Unencoded Route Parameters Lead to Open Redirects
Summary
CVE-2026-107718: AdonisJS: Unencoded route parameters can produce open redirects. Affects @adonisjs/http-server across 2 version ranges.
< 8.2.3
>= 9.0.0, < 9.3.0
Fixed in 8.2.3 or 9.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AdonisJS is a Node.js MVC framework that provides a robust set of tools for building web applications. The @adonisjs/http-server package is responsible for handling HTTP requests and responses, including routing. This package is widely used in AdonisJS applications to manage routes and serve content. However, it has a vulnerability that allows unencoded route parameters to create open redirects, potentially leading to security issues.
Vulnerability Detail
The vulnerability arises from the way route parameters are inserted into generated URLs without proper URI encoding. When an application uses dynamic route segments and passes untrusted input, an attacker can craft a malicious input that begins with a forward slash ('/'). This can lead to the generation of a scheme-relative URL, causing the application to redirect users to an external site controlled by the attacker. For example, a redirect to '/evil.example.com' would be interpreted by browsers as 'https://evil.example.com', facilitating phishing attacks and potentially compromising user credentials.
How To Fix
Latest published version: 9.3.1 as of 22 Oct 2026
npm install @adonisjs/http-server@9.3.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.2.38.2.3npm install @adonisjs/http-server@8.2.3 -
>= 9.0.0, < 9.3.09.3.0npm install @adonisjs/http-server@9.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot immediately update the package, you can implement a temporary workaround by manually encoding route parameters before passing them to the redirect function. For example:
response.redirect().toRoute('pages.show', { page: encodeURIComponent('/evil.example.com') });
This ensures that the malicious input is encoded and does not lead to an open redirect.
Conclusion
The vulnerability CVE-2026-107718 in the @adonisjs/http-server package allows for open redirects due to unencoded route parameters. It is crucial for developers using this package to update to the latest patched versions to mitigate the risk of exploitation. Implementing the suggested workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for @adonisjs/http-server →
FAQ
An open redirect is a vulnerability that allows an attacker to redirect users to an external site without their consent, often leading to phishing attacks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability can lead to phishing attacks, where users are redirected to malicious sites, potentially compromising their personal information and credentials.
No, the vulnerability affects versions prior to v9.3.0 and v8.2.3. Updating to these versions will resolve the issue.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @adonisjs/http-server.
