{"id":"GHSA-6qvv-pj99-48qm","revision":"d7ea8dad73e34b908575da97dd1ac624","records":[{"revision":"d7ea8dad73e34b908575da97dd1ac624","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-6qvv-pj99-48qm","aliases":["CVE-2026-40255"],"title":"@adonisjs/http-server has an Open Redirect vulnerability","description":"### Impact\n\nThe `response.redirect().back()` method in `@adonisjs/http-server` is vulnerable to open redirects. The method reads the `Referer` header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the `Referer` header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site.\n\nThis affects all AdonisJS applications that use `response.redirect().back()` or `response.redirect('back')`.\n\nThe vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect').\n\n### Patches\n\nThis has been fixed in `@adonisjs/http-server` version **8.2.0**. The `back()` method now validates the `Referer` header's host against the request's own `Host` header. Referrers from unrecognized hosts are rejected and the redirect falls back to `/` (or a developer-provided fallback URL).\n\nApplications that operate across multiple domains can configure additional trusted hosts via the `redirect.allowedHosts` option in `config/app.ts`.\n\nUsers should upgrade to `@adonisjs/http-server@^8.2.0` (or `@adonisjs/core@^7.4.0` if using the core meta-package).\n\n### Workarounds\n\nIf upgrading is not immediately possible, avoid using `response.redirect().back()` in routes that are reachable by unauthenticated users or from pages that accept external traffic. Instead, redirect to a known safe path explicitly using `response.redirect().toPath('/dashboard')`.\n\n### References\n\n- [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)\n- [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)","state":0,"publishedAt":"2026-04-14T20:01:28+00:00","modifiedAt":"2026-05-05T16:02:42.354824+00:00","affected":[{"ecosystem":"npm","name":"@adonisjs/http-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0-next.0"},{"kind":"fixed","version":"8.2.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@adonisjs/core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.3.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@adonisjs/http-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.8.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm","https://nvd.nist.gov/vuln/detail/CVE-2026-40255","https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08","https://github.com/adonisjs/http-server","https://github.com/adonisjs/http-server/releases/tag/v7.8.1","https://github.com/adonisjs/http-server/releases/tag/v8.2.0"],"sourceUrl":"https://github.com/advisories/GHSA-6qvv-pj99-48qm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6qvv-pj99-48qm","identifiers":["GHSA-6qvv-pj99-48qm","CVE-2026-40255"]},"retained":false,"historicalAffected":[]}],"coverage":[]}