Executive brief
@adonisjs/http-server is a popular Node.js HTTP server framework used in AdonisJS applications. The response.redirect().back() method fails to validate the HTTP Referer header before redirecting users, allowing attackers to redirect users to malicious external sites by controlling the Referer header. This can be exploited to perform phishing attacks or redirect users away from legitimate services.
Technical details
The vulnerability is a CWE-601 open redirect flaw in the response.redirect().back() method. The method reads the Referer header from incoming HTTP requests and performs a redirect without validating that the Referer host matches the application's host. An attacker can influence the Referer header by linking a user through an attacker-controlled page before triggering a form submission in the target application. The fix, deployed in @adonisjs/http-server version 8.2.0 and @adonisjs/core version 7.3.1, validates the Referer header's host against the request's Host header and rejects mismatched hosts, falling back to "/" or a developer-configured fallback URL. The vulnerability affects all versions prior to the patched releases.
Affected products
- AdonisJS http-server < 8.2.0 and < 7.8.1 (branch 7.x)
- AdonisJS core < 7.3.1
Timeline
- 2026-04-14: disclosed: Vulnerability published by AdonisJS maintainers
- 2026-04-14: patched: @adonisjs/http-server version 8.2.0 and 7.8.1 released with fix
- 2026-04-14: patched: @adonisjs/core version 7.3.1 released with fix