CVE-2026-104150: Uncontrolled Resource Consumption in @adonisjs/http-server Due to Inefficient Regular Expression Complexity
Summary
CVE-2026-104150: AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity. Affects @adonisjs/http-server across 2 version ranges.
< 8.2.2
>= 9.0.0, < 9.1.1
Fixed in 8.2.2 or 9.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @adonisjs/http-server package is a core component of the AdonisJS framework, designed to handle HTTP requests and routing efficiently. It provides developers with tools to create robust web applications. However, a specific vulnerability in its slug route matcher can lead to significant performance issues, making it susceptible to denial-of-service attacks.
Vulnerability Detail
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the built-in AdonisJS slug route matcher. The regular expression used by router.matchers.slug() contains adjacent greedy quantifiers with overlapping character classes, which can lead to excessive CPU consumption when processing specially crafted URLs. This vulnerability allows an unauthenticated attacker to block the Node.js event loop, preventing the server from handling other requests, including unrelated routes and health-check endpoints. The complexity of the regular expression evaluation is approximately O(n^1.98), resulting in quadratic execution time under certain conditions.
How To Fix
Latest published version: 9.3.1 as of 22 Oct 2026
npm install @adonisjs/http-server@9.3.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.2.28.2.2npm install @adonisjs/http-server@8.2.2 -
>= 9.0.0, < 9.1.19.1.1npm install @adonisjs/http-server@9.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the router.matchers.slug() for any route parameters that can be controlled by an attacker. Instead, consider implementing a custom slug matcher that does not exhibit the same performance issues.
Conclusion
The CVE-2026-104150 vulnerability in the @adonisjs/http-server package poses a significant risk due to its potential for denial-of-service attacks. It is crucial for developers using this package to update to the latest patched versions to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for @adonisjs/http-server →
FAQ
CVE-2026-104150 is a vulnerability in the @adonisjs/http-server package that allows for denial-of-service attacks due to inefficient regular expression complexity.
An attacker can exploit this vulnerability by sending specially crafted requests to routes that use the vulnerable slug matcher, causing excessive CPU consumption.
The vulnerability can lead to the Node.js event loop being blocked, preventing the server from processing other requests and potentially causing service outages.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If you cannot update the package right away, consider implementing a custom slug matcher or avoid using the vulnerable matcher for any user-controlled parameters as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for @adonisjs/http-server.
