CVE-2026-107718

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.

Route parameters are inserted into generated URLs without URI encoding.

When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:

router.get('/:page', handler).as('pages.show')

response.redirect().toRoute('pages.show', {
  page: '/evil.example.com',
})

This generates the following redirect:

Location: //evil.example.com

Browsers interpret this value as an external URL and redirect the user to https://evil.example.com.

Details

The shared createURL() helper is used by route URL builders, including Router.makeUrl() and Response.redirect().toRoute().

Route parameter values were appended without encoding:

if (isDefined) {
  uriSegments.push(`${value}${token.end}`)
}

Wildcard parameters had the same behavior:

uriSegments.push(`${values.join('/')}${token.end}`)

The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination.

Impact

An attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website.

This can facilitate phishing and may be chained with authentication or OAuth flows that rely on trusted redirect destinations.

Applications are affected when they:

• define a route whose first path segment is dynamic; and
• pass request-derived data to that segment when generating a redirect URL.

Patches

Route parameter values are now encoded using encodeURIComponent.

Wildcard values are encoded individually before being joined with /, preserving their intended segment separators:

if (isDefined) {
  uriSegments.push(`${encodeURIComponent(String(value))}${token.end}`)
}

uriSegments.push(
  `${values.map((value) => encodeURIComponent(String(value))).join('/')}${token.end}`
)

With the fix, /evil.example.com becomes:

/%2Fevil.example.com

Fixes targeting v6 and v7 have been published below.

• https://github.com/adonisjs/http-server/releases/tag/v8.2.3
• https://github.com/adonisjs/http-server/releases/tag/v9.3.0

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.

Route parameters are inserted into generated URLs without URI encoding.

When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:

router.get('/:page', handler).as('pages.show')

response.redirect().toRoute('pages.show', {
  page: '/evil.example.com',
})

This generates the following redirect:

Location: //evil.example.com

Browsers interpret this value as an external URL and redirect the user to https://evil.example.com.

Details

The shared createURL() helper is used by route URL builders, including Router.makeUrl() and Response.redirect().toRoute().

Route parameter values were appended without encoding:

if (isDefined) {
  uriSegments.push(`${value}${token.end}`)
}

Wildcard parameters had the same behavior:

uriSegments.push(`${values.join('/')}${token.end}`)

The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination.

Impact

An attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website.

This can facilitate phishing and may be chained with authentication or OAuth flows that rely on trusted redirect destinations.

Applications are affected when they:

• define a route whose first path segment is dynamic; and
• pass request-derived data to that segment when generating a redirect URL.

Patches

Route parameter values are now encoded using encodeURIComponent.

Wildcard values are encoded individually before being joined with /, preserving their intended segment separators:

if (isDefined) {
  uriSegments.push(`${encodeURIComponent(String(value))}${token.end}`)
}

uriSegments.push(
  `${values.map((value) => encodeURIComponent(String(value))).join('/')}${token.end}`
)

With the fix, /evil.example.com becomes:

/%2Fevil.example.com

Fixes targeting v6 and v7 have been published below.

• https://github.com/adonisjs/http-server/releases/tag/v8.2.3
• https://github.com/adonisjs/http-server/releases/tag/v9.3.0

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.