CVE-2026-40255: falha de média gravidade em adonisjs http-server
@adonisjs/http-server has an Open Redirect vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.2%
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVEs relacionadas — adonisjs http-server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-104150HIGHAdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression ComplexityEPSS 0.4%CVE-2026-61526MEDIUMAdonisJS HTTP Server is vulnerable to reflected XSS through its exception handlerEPSS 0.3%CVE-2026-107718MEDIUMAdonisJS: Unencoded route parameters can produce open redirectsEPSS 0.3%