npmPackage

@adonisjs/http-server

3 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-104150
Affects 1.2.4 to 8.2.1 (8.2.2 is outside it); 9.0.0 to 9.1.0 (9.1.1 is outside it)
CVE-2026-107718
Affects 1.2.4 to 8.2.2 (8.2.3 is outside it); 9.0.0 to 9.2.0 (9.3.0 is outside it)
CVE-2026-40255
Affects 1.2.4 to 7.8.0 (7.8.1 is outside it); 8.0.0-next.0 to 8.1.3 (8.2.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-104150High 8.7
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
Affected: from 9.0.0, fixed in 9.1.1; fixed in 8.2.2.
Fixed in 8.2.2 (released Jul 27, 2026, 80 days before disclosure) and 9.1.1 (released Jul 27, 2026, 80 days before disclosure).
The latest release, 9.3.1, is not affected.
58% of @adonisjs/http-server downloads last week were affected versions (167.1K).
CVE-2026-107718Medium 6.1
AdonisJS: Unencoded route parameters can produce open redirects
Affected: from 9.0.0, fixed in 9.3.0; fixed in 8.2.3.
Fixed in 8.2.3 (released Aug 24, 2026, 45 days before disclosure) and 9.3.0 (released Aug 24, 2026, 45 days before disclosure).
The latest release, 9.3.1, is not affected.
61% of @adonisjs/http-server downloads last week were affected versions (174.5K).
CVE-2026-40255Medium 6.1
@adonisjs/http-server has an Open Redirect vulnerability
Affected: from 8.0.0-next.0, fixed in 8.2.0; fixed in 7.8.1.
Fixed in 7.8.1 (released Apr 14, 2026, 2 days before disclosure) and 8.2.0 (released Apr 9, 2026, 7 days before disclosure).
The latest release, 9.3.1, is not affected.
19% of @adonisjs/http-server downloads last week were affected versions (54.4K).