{"id":"CVE-2026-107718","aliases":["AZL-106833","EUVD-2026-95342","GHSA-2m6q-8v3h-jqww"],"status":"published","title":"AdonisJS: Unencoded route parameters can produce open redirects","description":"AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00278,"percentile":0.20518,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2026-10-08T21:39:54Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"npm","package":"@adonisjs/http-server","fixed_in":["9.3.0","8.2.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@adonisjs/http-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"last_affected":"9.2.0"},{"fixed":"9.3.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@adonisjs/http-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.2.2"},{"fixed":"8.2.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.68-1"}]}]},{"source":"osv","ecosystem":"npm","package":"@adonisjs/http-server","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.3.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@adonisjs/http-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.2.3"}]}]}],"products":[{"vendor":"adonisjs","product":"http-server"}],"references":[{"url":"https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/adonisjs/http-server/releases/tag/v8.2.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/adonisjs/http-server/releases/tag/v9.3.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-2m6q-8v3h-jqww"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107718","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107718.json","tags":["advisory"]},{"url":"https://github.com/adonisjs/http-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-107718","title":"AdonisJS: Unencoded route parameters can produce open redirects","description":"AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.","status":"published","published":"2026-10-08T21:39:54.474Z","modified":"2026-10-14T01:24:14.635Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-95342","description":"AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.","status":"published","published":"2026-10-08T21:39:54Z","modified":"2026-10-14T01:24:14Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:18.393051Z"}],"ghsa":[{"id":"GHSA-2m6q-8v3h-jqww","title":"AdonisJS: Unencoded route parameters can produce open redirects","description":"Route parameters are inserted into generated URLs without URI encoding.\n\nWhen an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:\n\n```ts\nrouter.get('/:page', handler).as('pages.show')\n\nresponse.redirect().toRoute('pages.show', {\n  page: '/evil.example.com',\n})\n```\n\nThis generates the following redirect:\n\n```http\nLocation: //evil.example.com\n```\n\nBrowsers interpret this value as an external URL and redirect the user to `https://evil.example.com`.\n\n## Details\n\nThe shared `createURL()` helper is used by route URL builders, including `Router.makeUrl()` and `Response.redirect().toRoute()`.\n\nRoute parameter values were appended without encoding:\n\n```ts\nif (isDefined) {\n  uriSegments.push(`${value}${token.end}`)\n}\n```\n\nWildcard parameters had the same behavior:\n\n```ts\nuriSegments.push(`${values.join('/')}${token.end}`)\n```\n\n**The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination.**\n\n## Impact\n\nAn attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website.\n\nThis can facilitate phishing and may be chained with authentication or OAuth flows that rely on trusted redirect destinations.\n\nApplications are affected when they:\n- define a route whose first path segment is dynamic; and\n- pass request-derived data to that segment when generating a redirect URL.\n\n## Patches\n\nRoute parameter values are now encoded using `encodeURIComponent`.\n\nWildcard values are encoded individually before being joined with `/`, preserving their intended segment separators:\n\n```ts\nif (isDefined) {\n  uriSegments.push(`${encodeURIComponent(String(value))}${token.end}`)\n}\n```\n\n```ts\nuriSegments.push(\n  `${values.map((value) =\u003e encodeURIComponent(String(value))).join('/')}${token.end}`\n)\n```\n\nWith the fix, `/evil.example.com` becomes:\n\n```\n/%2Fevil.example.com\n```\n\nFixes targeting v6 and v7 have been published below.\n- https://github.com/adonisjs/http-server/releases/tag/v8.2.3\n- https://github.com/adonisjs/http-server/releases/tag/v9.3.0","status":"published","published":"2026-10-08T22:09:06Z","modified":"2026-10-08T22:09:07Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:41:30.097746Z"}],"nvd":[{"id":"CVE-2026-107718","description":"AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.","status":"published","published":"2026-10-08T22:17:27.747Z","modified":"2026-10-14T02:16:57.74Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"CVE-2026-107718","title":"AdonisJS: Unencoded route parameters can produce open redirects","description":"AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.","status":"published","published":"2026-10-08T21:39:54.474Z","modified":"2026-10-28T02:30:51.101269662Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"GHSA-2m6q-8v3h-jqww","title":"AdonisJS: Unencoded route parameters can produce open redirects","description":"Route parameters are inserted into generated URLs without URI encoding.\n\nWhen an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:\n\n```ts\nrouter.get('/:page', handler).as('pages.show')\n\nresponse.redirect().toRoute('pages.show', {\n  page: '/evil.example.com',\n})\n```\n\nThis generates the following redirect:\n\n```http\nLocation: //evil.example.com\n```\n\nBrowsers interpret this value as an external URL and redirect the user to `https://evil.example.com`.\n\n## Details\n\nThe shared `createURL()` helper is used by route URL builders, including `Router.makeUrl()` and `Response.redirect().toRoute()`.\n\nRoute parameter values were appended without encoding:\n\n```ts\nif (isDefined) {\n  uriSegments.push(`${value}${token.end}`)\n}\n```\n\nWildcard parameters had the same behavior:\n\n```ts\nuriSegments.push(`${values.join('/')}${token.end}`)\n```\n\n**The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination.**\n\n## Impact\n\nAn attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website.\n\nThis can facilitate phishing and may be chained with authentication or OAuth flows that rely on trusted redirect destinations.\n\nApplications are affected when they:\n- define a route whose first path segment is dynamic; and\n- pass request-derived data to that segment when generating a redirect URL.\n\n## Patches\n\nRoute parameter values are now encoded using `encodeURIComponent`.\n\nWildcard values are encoded individually before being joined with `/`, preserving their intended segment separators:\n\n```ts\nif (isDefined) {\n  uriSegments.push(`${encodeURIComponent(String(value))}${token.end}`)\n}\n```\n\n```ts\nuriSegments.push(\n  `${values.map((value) =\u003e encodeURIComponent(String(value))).join('/')}${token.end}`\n)\n```\n\nWith the fix, `/evil.example.com` becomes:\n\n```\n/%2Fevil.example.com\n```\n\nFixes targeting v6 and v7 have been published below.\n- https://github.com/adonisjs/http-server/releases/tag/v8.2.3\n- https://github.com/adonisjs/http-server/releases/tag/v9.3.0","status":"published","published":"2026-10-08T22:09:06Z","modified":"2026-10-08T22:30:09.030589206Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"AZL-106833","title":"CVE-2026-107718 affecting package httpd 2.4.68-1","description":"AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.","status":"published","published":"2026-10-08T22:17:27Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"}]}}