AdonisJS HTTP Server EUVD-2026-102320

Exploitable only when the application explicitly applies router.matchers.slug() to an attacker-controlled route parameter - this is the precise prerequisite feature, not a default for every AdonisJS app. Where that matcher is used, no authentication or user interaction is required (PR:N/UI:N) and the attack reaches the vulnerable regex before any route/group middleware runs, so authentication and rate-limiting middleware on the route do NOT prevent it. The practical limiting factors are therefore: (1) the app must use the slug matcher on an externally reachable route, and (2) impact is availability-only (event-loop stall / worker DoS) with no data exposure; versions 8.2.2 and 9.1.1 remove the backtracking regex.

This is a genuine availability risk for the specific population of applications that use it, but not a universal emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the description agree cleanly: a single unauthenticated network request carrying a crafted slug triggers quadratic regex backtracking (ReDoS, CWE-400) that stalls the Node.js single-threaded event loop, blocking the worker from serving any other request or health check. The 8.7 score is driven entirely by VA:H (availability); there is no confidentiality or integrity impact (VC:N/VI:N), so this is a pure DoS. A notable amplifier, stated explicitly in the description and traceable to AdonisJS routing internals, is that route matching runs BEFORE route/group middleware, so authentication and rate-limiting middleware do NOT shield the vulnerable matcher - the usual mitigating controls are bypassed. The key qualifier that lowers real-world priority is that the flaw only manifests when an application actually applies router.matchers.slug() to an attacker-controlled route parameter; applications that do not use this matcher are unaffected. No EPSS score and no CISA KEV entry were provided, and there is no evidence of active exploitation - exploitation status is therefore: no confirmed active exploitation. A reproducing regression test shipping in the fix commit demonstrates the backtracking with a 50,000-character malicious slug, so a working reproduction is publicly available. Net: a legitimately high-severity DoS for affected deployments, worth prompt patching, but its blast radius is gated by whether the slug matcher is in use rather than being a blanket remote-DoS against all AdonisJS apps.

An unauthenticated attacker identifies a route whose parameter is validated with router.matchers.slug() and sends a request containing a very long slug (e.g. tens of thousands of characters) ending in a character the final assertion rejects, such as an underscore. The regex enters quadratic backtracking, pinning a CPU core and freezing the Node.js event loop so the worker can no longer serve legitimate traffic or respond to health checks. A publicly reproducing test case (50,000 'a' characters followed by '_') exists in the fix commit, making the condition trivial to reproduce.