CVE-2026-40255: medium-severity vulnerability in adonisjs http-server
@adonisjs/http-server has an Open Redirect vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.2%
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Related CVEs — adonisjs http-server
In the same product, most dangerous first.
CVE-2026-104150HIGHAdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression ComplexityEPSS 0.4%CVE-2026-61526MEDIUMAdonisJS HTTP Server is vulnerable to reflected XSS through its exception handlerEPSS 0.3%CVE-2026-107718MEDIUMAdonisJS: Unencoded route parameters can produce open redirectsEPSS 0.3%