CVE-2026-40255: Open Redirect Vulnerability in @adonisjs/http-server
Summary
CVE-2026-40255: URL Redirection to Untrusted Site ('Open Redirect') in @adonisjs/http-server. Affects @adonisjs/http-server across 2 version ranges.
< 7.8.1
>= 8.0.0-next.0, < 8.2.0
Fixed in 7.8.1 or 8.2.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @adonisjs/http-server package is a core component of the AdonisJS framework, designed to handle HTTP requests and responses in web applications. It provides various methods for managing responses, including redirection capabilities. However, a flaw in the implementation of the response.redirect().back() method has exposed applications using this package to potential security risks, specifically open redirects.
Vulnerability Detail
The vulnerability arises from the response.redirect().back() method, which reads the Referer header from incoming HTTP requests and redirects users to that URL without validating the host. This lack of validation allows attackers to manipulate the Referer header, potentially redirecting users to malicious external sites. The issue is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect'). If exploited, this vulnerability can lead to phishing attacks and loss of user trust.
How To Fix
Latest published version: 9.3.1 as of 22 Oct 2026
npm install @adonisjs/http-server@9.3.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.8.17.8.1npm install @adonisjs/http-server@7.8.1 -
>= 8.0.0-next.0, < 8.2.08.2.0npm install @adonisjs/http-server@8.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, avoid using response.redirect().back() in routes accessible by unauthenticated users or from pages that accept external traffic. Instead, explicitly redirect to a known safe path using the following code:
response.redirect().toPath('/dashboard');
Conclusion
The CVE-2026-40255 vulnerability in the @adonisjs/http-server package poses a significant risk due to its open redirect capabilities. It is crucial for developers to upgrade to the patched version or implement the suggested workarounds to mitigate potential security threats.
See every vulnerability recorded for @adonisjs/http-server →
FAQ
An open redirect vulnerability allows attackers to redirect users to untrusted sites without proper validation, potentially leading to phishing attacks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If an upgrade is not feasible, implement the recommended workaround by avoiding the use of response.redirect().back() in vulnerable routes.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of severity.
Additional details can be found in the official advisory on GitHub or by referring to the CWE-601 documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @adonisjs/http-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
