GHSA-2M6Q-8V3H-JQWW
Vulnerability from github – Published: 2026-10-08 22:09 – Updated: 2026-10-08 22:09Route parameters are inserted into generated URLs without URI encoding.
When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:
router.get('/:page', handler).as('pages.show')
response.redirect().toRoute('pages.show', {
page: '/evil.example.com',
})
This generates the following redirect:
Location: //evil.example.com
Browsers interpret this value as an external URL and redirect the user to https://evil.example.com.
Details
The shared createURL() helper is used by route URL builders, including Router.makeUrl() and Response.redirect().toRoute().
Route parameter values were appended without encoding:
if (isDefined) {
uriSegments.push(`${value}${token.end}`)
}
Wildcard parameters had the same behavior:
uriSegments.push(`${values.join('/')}${token.end}`)
The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination.
Impact
An attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website.
This can facilitate phishing and may be chained with authentication or OAuth flows that rely on trusted redirect destinations.
Applications are affected when they: - define a route whose first path segment is dynamic; and - pass request-derived data to that segment when generating a redirect URL.
Patches
Route parameter values are now encoded using encodeURIComponent.
Wildcard values are encoded individually before being joined with /, preserving their intended segment separators:
if (isDefined) {
uriSegments.push(`${encodeURIComponent(String(value))}${token.end}`)
}
uriSegments.push(
`${values.map((value) => encodeURIComponent(String(value))).join('/')}${token.end}`
)
With the fix, /evil.example.com becomes:
/%2Fevil.example.com
Fixes targeting v6 and v7 have been published below. - https://github.com/adonisjs/http-server/releases/tag/v8.2.3 - https://github.com/adonisjs/http-server/releases/tag/v9.3.0
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.2.0"
},
"package": {
"ecosystem": "npm",
"name": "@adonisjs/http-server"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.3.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.2.2"
},
"package": {
"ecosystem": "npm",
"name": "@adonisjs/http-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-107718"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-08T22:09:06Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Route parameters are inserted into generated URLs without URI encoding.\n\nWhen an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:\n\n```ts\nrouter.get(\u0027/:page\u0027, handler).as(\u0027pages.show\u0027)\n\nresponse.redirect().toRoute(\u0027pages.show\u0027, {\n page: \u0027/evil.example.com\u0027,\n})\n```\n\nThis generates the following redirect:\n\n```http\nLocation: //evil.example.com\n```\n\nBrowsers interpret this value as an external URL and redirect the user to `https://evil.example.com`.\n\n## Details\n\nThe shared `createURL()` helper is used by route URL builders, including `Router.makeUrl()` and `Response.redirect().toRoute()`.\n\nRoute parameter values were appended without encoding:\n\n```ts\nif (isDefined) {\n uriSegments.push(`${value}${token.end}`)\n}\n```\n\nWildcard parameters had the same behavior:\n\n```ts\nuriSegments.push(`${values.join(\u0027/\u0027)}${token.end}`)\n```\n\n**The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination.**\n\n## Impact\n\nAn attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website.\n\nThis can facilitate phishing and may be chained with authentication or OAuth flows that rely on trusted redirect destinations.\n\nApplications are affected when they:\n- define a route whose first path segment is dynamic; and\n- pass request-derived data to that segment when generating a redirect URL.\n\n## Patches\n\nRoute parameter values are now encoded using `encodeURIComponent`.\n\nWildcard values are encoded individually before being joined with `/`, preserving their intended segment separators:\n\n```ts\nif (isDefined) {\n uriSegments.push(`${encodeURIComponent(String(value))}${token.end}`)\n}\n```\n\n```ts\nuriSegments.push(\n `${values.map((value) =\u003e encodeURIComponent(String(value))).join(\u0027/\u0027)}${token.end}`\n)\n```\n\nWith the fix, `/evil.example.com` becomes:\n\n```\n/%2Fevil.example.com\n```\n\nFixes targeting v6 and v7 have been published below.\n- https://github.com/adonisjs/http-server/releases/tag/v8.2.3\n- https://github.com/adonisjs/http-server/releases/tag/v9.3.0",
"id": "GHSA-2m6q-8v3h-jqww",
"modified": "2026-10-08T22:09:06Z",
"published": "2026-10-08T22:09:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww"
},
{
"type": "WEB",
"url": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d"
},
{
"type": "WEB",
"url": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a"
},
{
"type": "PACKAGE",
"url": "https://github.com/adonisjs/http-server"
},
{
"type": "WEB",
"url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3"
},
{
"type": "WEB",
"url": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "AdonisJS: Unencoded route parameters can produce open redirects"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.