CVE-2026-40255
published 2026-04-16CVE-2026-40255: AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0…
PriorityP430medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.25%
15.9th percentile
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adonisjs | core | <= 7.3.0 | — |
| adonisjs | core | 0 – 7.3.1 | — |
| adonisjs | http-core | < 7.4.0 | 7.4.0 |
| adonisjs | http-server | < 7.8.1 | 7.8.1 |
| adonisjs | http-server | <= 8.1.3 | — |
| adonisjs | http-server | — | — |
| adonisjs | http-server | >= 0 < 7.8.1 | 7.8.1 |
| adonisjs | http-server | >= 8.0.0-next.0 < 8.2.0 | 8.2.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
adonisjs http-server/http-core prior v7.8.1 response.redirect (GHSA-6qvv-pj99-48qm / CNNVD-202604-3432)
vuldb·2026-04-17·CVSS 6.1
CVE-2026-40255 [MEDIUM] adonisjs http-server/http-core prior v7.8.1 response.redirect (GHSA-6qvv-pj99-48qm / CNNVD-202604-3432)
A vulnerability categorized as problematic has been discovered in adonisjs http-server and http-core. This issue affects the function response.redirect. Executing a manipulation can lead to open redirect.
This vulnerability appears as CVE-2026-40255. The attack may be performed from remote. There is no available exploit.
It is advisable to upgrade the affected component.
GHSA
@adonisjs/http-server has an Open Redirect vulnerability
ghsa·2026-04-14
CVE-2026-40255 [MEDIUM] CWE-601 @adonisjs/http-server has an Open Redirect vulnerability
@adonisjs/http-server has an Open Redirect vulnerability
### Impact
The `response.redirect().back()` method in `@adonisjs/http-server` is vulnerable to open redirects. The method reads the `Referer` header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the `Referer` header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site.
This affects all AdonisJS applications that use `response.redirect().back()` or `response.redirect('back')`.
The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect').
### Patches
This has been fixed in `@adonisjs/http-server` version **8.2.0**.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-16
Published