Unvalidated Redirects in AdonisJS HTTP Server Package

CVE-2026-40255

What is CVE-2026-40255?

The AdonisJS HTTP Server package contains a vulnerability that allows an attacker to exploit the response.redirect().back() method. In the affected versions, this method reads the Referer header from incoming HTTP requests and redirects users without validating the host. If an attacker manipulates the Referer header, they can redirect users to a malicious external site, potentially leading to phishing or other attacks. This vulnerability impacts all AdonisJS applications utilizing the outdated redirect methods, making them susceptible to unauthorized redirections. The issue has been resolved in later versions.

References