CVE-2026-40255: fallo de gravedad media en adonisjs http-server
@adonisjs/http-server has an Open Redirect vulnerability
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.2%
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVEs relacionadas — adonisjs http-server
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-104150HIGHAdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression ComplexityEPSS 0.4%CVE-2026-61526MEDIUMAdonisJS HTTP Server is vulnerable to reflected XSS through its exception handlerEPSS 0.3%CVE-2026-107718MEDIUMAdonisJS: Unencoded route parameters can produce open redirectsEPSS 0.3%