HTTP Server Vulnerability in AdonisJS Framework from AdonisJs

CVE-2026-104150

What is CVE-2026-104150?

The AdonisJS HTTP Server package, utilized for processing HTTP requests within the AdonisJS framework, is affected by a performance degradation issue. Specifically, older versions (prior to 8.2.2 and 9.1.1) contain a regex in the router.matchers.slug() method that can trigger excessive CPU usage due to adjacent greedy repetitions in overlapping character classes. Exploiting this vulnerability allows attackers to craft a long slug that causes quadratic backtracking, leading to significant delays and potentially blocking the Node.js event loop. This impedes the server's ability to process legitimate requests and perform health checks, as route matching occurs before any applied middleware for authentication or rate-limiting. The issue has been addressed in the referenced updates.

References