AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-104150 · Microsoft / collected KEV context

EUVD-2026-102320

GHSA-524c-h47v-m3h8

cve-program · CVE-2026-104150

• https://github.com/adonisjs/http-server/security/advisories/GHSA-524c-h47v-m3h8
• https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7
• https://github.com/adonisjs/http-server/commit/d8c749aa9f66d5d214bad1cad727264aef4be727
• https://github.com/adonisjs/http-server/releases/tag/v8.2.2
• https://github.com/adonisjs/http-server/releases/tag/v9.1.1

euvd · EUVD-2026-102320

• https://github.com/adonisjs/http-server/security/advisories/GHSA-524c-h47v-m3h8
• https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7
• https://github.com/adonisjs/http-server/commit/d8c749aa9f66d5d214bad1cad727264aef4be727
• https://github.com/adonisjs/http-server/releases/tag/v8.2.2
• https://github.com/adonisjs/http-server/releases/tag/v9.1.1

nvd · CVE-2026-104150

• https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7
• https://github.com/adonisjs/http-server/commit/d8c749aa9f66d5d214bad1cad727264aef4be727
• https://github.com/adonisjs/http-server/releases/tag/v8.2.2
• https://github.com/adonisjs/http-server/releases/tag/v9.1.1
• https://github.com/adonisjs/http-server/security/advisories/GHSA-524c-h47v-m3h8

osv · GHSA-524c-h47v-m3h8

• https://github.com/adonisjs/http-server/security/advisories/GHSA-524c-h47v-m3h8
• https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7
• https://github.com/adonisjs/http-server/commit/d8c749aa9f66d5d214bad1cad727264aef4be727
• https://github.com/adonisjs/http-server
• https://github.com/adonisjs/http-server/releases/tag/v8.2.2
• https://github.com/adonisjs/http-server/releases/tag/v9.1.1

• AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character clas… · Advisory content revised · 1 Nov 2026