fkie_cve-2026-107718

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.

GHSA-2m6q-8v3h-jqww — AdonisJS: Unencoded route parameters can produce open redirects

Affected: npm: @adonisjs/http-server

Route parameters are inserted into generated URLs without URI encoding.

When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:

```ts router.get('/:page', handler).as('pages.show')

response.redirect().toRoute('pages.show', { page: '/evil.example.com', }) ```

This generates the following redirect:

```http Location: //evil.example.com ```

Browsers interpret this value as an external URL and redirect the user to `https://evil.example.com`.

## Details

The shared `createURL()` helper is used by route URL builders, including `Router.makeUrl()` and `Response.redirect().toRoute()`.

Route parameter values were appended without encoding:

```ts if (isDefined) { uriSegments.push(`${value}${token.end}`) } ```

Wildcard parameters had the same behavior:

```ts uriSegments.push(`${values.join('/')}${token.end}`) ```

**The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination.**

## Impact

An attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website.

This can facilitate phishing and may be chained with authentication or OAuth flows that rely on trusted redirect destinations.

Applications are affected when they: - define a route whose first path se…

Most recent entries from all

fkie_cve-2026-107718

GHSA-2m6q-8v3h-jqww — AdonisJS: Unencoded route parameters can produce open redirects