AdonisJS HTTP Server Vulnerability in Version Ranges Allowing JavaScript Execution
CVE-2026-61526

6.1MEDIUM

Key Information:

Vendor

Adonisjs

Status
Http-server
Vendor
CVE Published:
30 July 2026

What is CVE-2026-61526?

A vulnerability exists in the AdonisJS HTTP Server where the error message is interpolated into the default HTML exception response without appropriate escaping. This enables potential attackers to execute malicious JavaScript via carefully crafted URLs when a missing route is accessed. This situation arises particularly when debug mode is disabled and there are no custom error pages to handle exceptions effectively. Users are advised to upgrade to versions 8.2.1 and 9.1.0, where this issue has been resolved.

Affected Version(s)

http-server >= 8.0.0-next.0, < 8.2.1 < 8.0.0-next.0, 8.2.1

http-server >= 9.0.0, < 9.1.0 < 9.0.0, 9.1.0

References

https://github.com/adonisjs/http-server/security/advisori...
x_refsource_CONFIRM
https://github.com/adonisjs/http-server/commit/5d7465d599...
x_refsource_MISC
https://github.com/adonisjs/http-server/commit/71a0a8e375...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.