Adonisjs vulnerabilities

Products

• Core 5
• Http-server 5
• Bodyparser 2

Newest

• adonisjs http-server AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity CVE-2026-104150 Fix available 8.7 HighOctober 15, 2026
• adonisjs http-server AdonisJS: Unencoded route parameters can produce open redirects CVE-2026-107718 Fix available 6.1 MediumOctober 8, 2026
• adonisjs http-server AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler CVE-2026-61526 6.1 MediumJuly 30, 2026
• adonisjs core Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser CVE-2026-48795 Fix available 8.6 HighJune 30, 2026
• adonisjs core, http-server, http-core +2 more @adonisjs/http-server has an Open Redirect vulnerability CVE-2026-40255 Fix available 6.1 MediumApril 14, 2026
• adonisjs bodyparser, core +1 more AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection CVE-2026-25762 Fix available 7.5 HighFebruary 6, 2026
• adonisjs bodyparser, core +1 more AdonisJS multipart body parsing has Prototype Pollution issue CVE-2026-25754 Fix available 7.2 HighFebruary 6, 2026
• adonisjs http-server C++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File Read CVE-2026-24469 7.5 HighJanuary 24, 2026
• adonisjs lucid Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State CVE-2026-22814 Fix available 8.2 HighJanuary 13, 2026
• adonisjs core AdonisJS Path Traversal in Multipart File Handling CVE-2026-21440 Public exploitFix available 9.2 CriticalJanuary 2, 2026
• adonisjs edge Cross-site Scripting (XSS) CVE-2021-23443 Fix available 5.4 MediumSeptember 21, 2021