Vulnerability-Lookup

CVE-2026-107718 (GCVE-0-2026-107718)

Vulnerability from cvelistv5 – Published: 2026-10-08 21:39 – Updated: 2026-10-08 21:39

Title

AdonisJS: Unencoded route parameters can produce open redirects

Summary

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7595 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/adonisjs/http-server/security/…	x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/45…	x_refsource_MISC
https://github.com/adonisjs/http-server/commit/ab…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC
https://github.com/adonisjs/http-server/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
adonisjs	http-server	Affected: < 8.2.3 Affected: >= 9.0.0, < 9.3.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T21:39:54.474Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d"
        },
        {
          "name": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3"
        },
        {
          "name": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-2m6q-8v3h-jqww",
        "discovery": "UNKNOWN"
      },
      "title": "AdonisJS: Unencoded route parameters can produce open redirects"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107718",
    "datePublished": "2026-10-08T21:39:54.474Z",
    "dateReserved": "2026-10-08T17:21:52.975Z",
    "dateUpdated": "2026-10-08T21:39:54.474Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-107718",
      "date": "2026-10-10",
      "epss": "0.00278",
      "percentile": "0.18651"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "http-server",
                "vendor": "adonisjs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 8.2.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 9.0.0, \u003c 9.3.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0."
          }
        ],
        "id": "CVE-2026-107718",
        "lastModified": "2026-10-09T17:08:31.663",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-08T22:17:27.747",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-601"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-107718

Vulnerability from fkie_nvd - Published: 2026-10-08 22:17 - Updated: 2026-10-09 17:08

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d
	security-advisories@github.com	https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a
	security-advisories@github.com	https://github.com/adonisjs/http-server/releases/tag/v8.2.3
	security-advisories@github.com	https://github.com/adonisjs/http-server/releases/tag/v9.3.0
	security-advisories@github.com	https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "http-server",
          "vendor": "adonisjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.3.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0."
    }
  ],
  "id": "CVE-2026-107718",
  "lastModified": "2026-10-09T17:08:31.663",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-08T22:17:27.747",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-2M6Q-8V3H-JQWW

Vulnerability from github – Published: 2026-10-08 22:09 – Updated: 2026-10-08 22:09

Summary

AdonisJS: Unencoded route parameters can produce open redirects

Details

Route parameters are inserted into generated URLs without URI encoding.

When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:

router.get('/:page', handler).as('pages.show')

response.redirect().toRoute('pages.show', {
  page: '/evil.example.com',
})

This generates the following redirect:

Location: //evil.example.com

Browsers interpret this value as an external URL and redirect the user to https://evil.example.com.

Details

The shared createURL() helper is used by route URL builders, including Router.makeUrl() and Response.redirect().toRoute().

Route parameter values were appended without encoding:

if (isDefined) {
  uriSegments.push(`${value}${token.end}`)
}

Wildcard parameters had the same behavior:

uriSegments.push(`${values.join('/')}${token.end}`)

The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination.

Impact

An attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website.

This can facilitate phishing and may be chained with authentication or OAuth flows that rely on trusted redirect destinations.

Applications are affected when they: - define a route whose first path segment is dynamic; and - pass request-derived data to that segment when generating a redirect URL.

Patches

Route parameter values are now encoded using encodeURIComponent.

Wildcard values are encoded individually before being joined with /, preserving their intended segment separators:

if (isDefined) {
  uriSegments.push(`${encodeURIComponent(String(value))}${token.end}`)
}

uriSegments.push(
  `${values.map((value) => encodeURIComponent(String(value))).join('/')}${token.end}`
)

With the fix, /evil.example.com becomes:

/%2Fevil.example.com

Fixes targeting v6 and v7 have been published below. - https://github.com/adonisjs/http-server/releases/tag/v8.2.3 - https://github.com/adonisjs/http-server/releases/tag/v9.3.0

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.2.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@adonisjs/http-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.2.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@adonisjs/http-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107718"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T22:09:06Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Route parameters are inserted into generated URLs without URI encoding.\n\nWhen an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:\n\n```ts\nrouter.get(\u0027/:page\u0027, handler).as(\u0027pages.show\u0027)\n\nresponse.redirect().toRoute(\u0027pages.show\u0027, {\n  page: \u0027/evil.example.com\u0027,\n})\n```\n\nThis generates the following redirect:\n\n```http\nLocation: //evil.example.com\n```\n\nBrowsers interpret this value as an external URL and redirect the user to `https://evil.example.com`.\n\n## Details\n\nThe shared `createURL()` helper is used by route URL builders, including `Router.makeUrl()` and `Response.redirect().toRoute()`.\n\nRoute parameter values were appended without encoding:\n\n```ts\nif (isDefined) {\n  uriSegments.push(`${value}${token.end}`)\n}\n```\n\nWildcard parameters had the same behavior:\n\n```ts\nuriSegments.push(`${values.join(\u0027/\u0027)}${token.end}`)\n```\n\n**The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination.**\n\n## Impact\n\nAn attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website.\n\nThis can facilitate phishing and may be chained with authentication or OAuth flows that rely on trusted redirect destinations.\n\nApplications are affected when they:\n- define a route whose first path segment is dynamic; and\n- pass request-derived data to that segment when generating a redirect URL.\n\n## Patches\n\nRoute parameter values are now encoded using `encodeURIComponent`.\n\nWildcard values are encoded individually before being joined with `/`, preserving their intended segment separators:\n\n```ts\nif (isDefined) {\n  uriSegments.push(`${encodeURIComponent(String(value))}${token.end}`)\n}\n```\n\n```ts\nuriSegments.push(\n  `${values.map((value) =\u003e encodeURIComponent(String(value))).join(\u0027/\u0027)}${token.end}`\n)\n```\n\nWith the fix, `/evil.example.com` becomes:\n\n```\n/%2Fevil.example.com\n```\n\nFixes targeting v6 and v7 have been published below.\n- https://github.com/adonisjs/http-server/releases/tag/v8.2.3\n- https://github.com/adonisjs/http-server/releases/tag/v9.3.0",
  "id": "GHSA-2m6q-8v3h-jqww",
  "modified": "2026-10-08T22:09:06Z",
  "published": "2026-10-08T22:09:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww"
    },
    {
      "type": "WEB",
      "url": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/adonisjs/http-server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AdonisJS: Unencoded route parameters can produce open redirects"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-107718 (GCVE-0-2026-107718)

FKIE_CVE-2026-107718

GHSA-2M6Q-8V3H-JQWW

Details

Impact

Patches

Tags

Sightings

Nomenclature

Related by attack behaviour