CVE-2026-40255: @adonisjs/http-server has an Open Redirect vulnerability

CVE-2026-40255 · Severity: medium · CVSS 6.1 · Published 2026-04-16

@adonisjs/http-server is a popular Node.js HTTP server framework used in AdonisJS applications. The response.redirect().back() method fails to validate the HTTP Referer header before redirecting users, allowing attackers to redirect users to malicious external sites by controlling the Referer header. This can be exploited to perform phishing attacks or redirect users away from legitimate services.

Technologies: AdonisJS Http-Server, @adonisjs/http-server (npm). Vendors: AdonisJS, npm.

Quick answers

Is CVE-2026-40255 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40255 being exploited in the wild.
How severe is CVE-2026-40255?
Medium severity, with a CVSS score of 6.1, published 16 April 2026.
Which products and versions are affected?
@adonisjs/core (npm) SEMVER:introduced=0,fixed=7.3.1; @adonisjs/http-server (npm) SEMVER:introduced=8.0.0-next.0,fixed=8.2.0.
Is there a fix for CVE-2026-40255?
Yes. @adonisjs/core (npm): upgrade to 7.3.1 or later; @adonisjs/http-server (npm): upgrade to 8.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40255 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40255?
Check whether you run AdonisJS Core, AdonisJS Http-Server, @adonisjs/core (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @adonisjs/core (npm): upgrade to 7.3.1 or later
    npm install @adonisjs/core@7.3.1
  • @adonisjs/http-server (npm): upgrade to 8.2.0 or later
    npm install @adonisjs/http-server@8.2.0

Technical details

The vulnerability is a CWE-601 open redirect flaw in the response.redirect().back() method. The method reads the Referer header from incoming HTTP requests and performs a redirect without validating that the Referer host matches the application's host. An attacker can influence the Referer header by linking a user through an attacker-controlled page before triggering a form submission in the target application. The fix, deployed in @adonisjs/http-server version 8.2.0 and @adonisjs/core version 7.3.1, validates the Referer header's host against the request's Host header and rejects mismatched hosts, falling back to "/" or a developer-configured fallback URL. The vulnerability affects all versions prior to the patched releases.

Affected products

  • AdonisJS http-server < 8.2.0 and < 7.8.1 (branch 7.x)
  • AdonisJS core < 7.3.1

Identifiers

  • CVE-2026-40255
  • GHSA-6qvv-pj99-48qm

Timeline

  • 2026-04-14: disclosed: Vulnerability published by AdonisJS maintainers
  • 2026-04-14: patched: @adonisjs/http-server version 8.2.0 and 7.8.1 released with fix
  • 2026-04-14: patched: @adonisjs/core version 7.3.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.