Executive brief
AdonisJS HTTP Server is a component used by the AdonisJS web framework to process incoming web requests. A security flaw in how it handles errors allows an attacker to create a malicious link that, if clicked by a user, could execute unauthorized code in their web browser. This could lead to the theft of user session information or unauthorized actions being performed on the user's behalf within the application.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in the AdonisJS HTTP exception handler (CWE-79). The root cause is the lack of proper escaping when the `error.message` is interpolated into the default HTML exception response, specifically when debug mode is disabled and no custom status page is defined. For missing routes, the exception message includes the requested URL, allowing an attacker to inject HTML or JavaScript event handlers. Exploitation requires a victim to visit a crafted URL. The issue has been fixed in versions 8.2.1 and 9.1.0 by ensuring exception messages are escaped before being rendered in HTML responses.
Affected products
- AdonisJS http-server 8.0.0-next.0 - 8.2.0, 9.0.0 - 9.0.2
Timeline
- 2026-06-22: patched: Versions 8.2.1 and 9.1.0 released
- 2026-07-27: advisory: GitHub Security Advisory GHSA-cwm9-gfhc-46f6 published
- 2026-07-30: disclosed: CVE-2026-61526 published to NVD
References
- https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87
- https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3
- https://github.com/adonisjs/http-server/releases/tag/v8.2.1
- https://github.com/adonisjs/http-server/releases/tag/v9.1.0
- https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6