AdonisJS HTTP Server CVE-2026-107718

Exploitation requires a specific application coding pattern, not a default configuration: the AdonisJS app must (1) define a route whose FIRST dynamic path segment (or a wildcard '*' parameter) is populated with attacker-controlled input, (2) generate that URL via Router.makeUrl()/urlFor() or Response.redirect().toRoute(), and (3) use the resulting string as an HTTP redirect destination. Only affected versions prior to 8.2.3 (v8 line) and 9.3.0 (v9 line) are vulnerable. Limiting factors: the victim must actively click the attacker-supplied link (UI:R); APIs that intentionally accept complete redirect URLs are explicitly NOT affected; and applications that do not feed untrusted data into a leading route segment used for redirection are unaffected regardless of version.

This is a moderate, conditional open-redirect (CWE-601) rather than a high-urgency issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 Medium) correctly reflects a network-reachable, unauthenticated flaw that nonetheless requires user interaction (victim must click a crafted link) and yields only limited confidentiality/integrity impact with no availability impact. No EPSS score, KEV listing, SSVC decision data, or POC reference was supplied, so there is no signal of active exploitation or automated weaponization - the realistic status is 'no public exploit identified at time of analysis.' Critically, the flaw is NOT exploitable against a default AdonisJS application: the vendor advisory and commit evidence show it only manifests when the application itself places attacker-controlled data into a dynamic first path segment (or wildcard) AND then uses the generated route URL as a redirect destination. This application-side prerequisite meaningfully lowers real-world risk below what the raw 6.1 score implies, making it a code-pattern-dependent weakness rather than a broadly exploitable vulnerability. The missing EPSS/KEV/POC data is an absence, not a contradiction, so the signals present here are internally consistent.

An AdonisJS application builds a route like '/:page' and uses Router.makeUrl() or Response.redirect().toRoute() with an unsanitized user-supplied value as the first path segment, then redirects the user there. An attacker supplies a value beginning with '/' (e.g. '/evil.example.com'), which the unencoded createURL() helper renders as a scheme-relative URL, redirecting the victim to an attacker-controlled site for phishing or OAuth/token abuse. No public exploit code was identified; exploitation requires the victim to follow the crafted link (UI:R).