AdonisJS HTTP Server: Regular expression denial of service in slug matcher
Summary
The HTTP Server package of the AdonisJS Node.js framework contains a regular expression in the built-in slug route matcher that can take excessive CPU time (ReDoS). An unauthenticated attacker can send a long, crafted slug in a route parameter that the matcher is applied to, which can block the Node.js event loop and stop the worker from serving other requests, including health checks. Route matching runs before route and group middleware, so authentication or rate limiting on the route may not prevent the request.
Affected
- @adonisjs/http-server versions before 8.2.2
- @adonisjs/http-server versions 9.0.0 up to (not including) 9.1.1
- Only applications that use router.matchers.slug() on attacker-controlled route parameters are affected.
Fixed in
- Upgrade to 8.2.2 or 9.1.1 (or a later release in the same line).
Workaround
Unknown. No vendor-documented workaround was found.
Exploitation
- No known exploitation in the wild found at the time of research. Unknown.
- No public proof of concept found at the time of research. Unknown.
- CVSS 4.0 base score 8.7 (High) per CNA; CVSS 3.1 score 7.5 (High) per Tenable. NVD analysis pending.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Check whether any internet-facing AdonisJS application uses @adonisjs/http-server below the fixed versions and whether it calls router.matchers.slug() on route parameters.
- Upgrade affected applications to 8.2.2 or 9.1.1, or a later release, in the next maintenance window.
- Until patched, restrict or proxy the affected routes at the reverse proxy or WAF and make sure health checks and process supervision can restart a blocked worker.
- Recheck CISA KEV and the vendor advisory before reporting to clients.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-524c-h47v-m3h8 github.com
- Release v8.2.2 github.com
- Release v9.1.1 github.com
- Fix commit 86af38c github.com
- Fix commit d8c749a github.com
- GitLab Advisory Database advisories.gitlab.com
- OSV CVE-2026-104150 osv.dev
- Tenable CVE-2026-104150 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:27.
Original description (NVD)
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.
NVD references (5)
- https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7
- https://github.com/adonisjs/http-server/commit/d8c749aa9f66d5d214bad1cad727264aef4be727
- https://github.com/adonisjs/http-server/releases/tag/v8.2.2
- https://github.com/adonisjs/http-server/releases/tag/v9.1.1
- https://github.com/adonisjs/http-server/security/advisories/GHSA-524c-h47v-m3h8
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.