Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Regular Expression Denial of Service vulnerability in the built-in AdonisJS slug route matcher may allow a remote attacker to block the Node.js event loop using a specially crafted URL. This affects applications using router.matchers.slug() on a route parameter reachable by an attacker. Details The regular expression used by router.matchers.slug() contains adjacent greedy quantifiers with overlapping character classes: When the matcher receives a long string ending with a character rejected by the final assertion, the regular expression engine must evaluate many possible ways of dividing the input between the overlapping quantifiers before determining that it does not match. This results in quadratic execution time. Testing measured an approximate complexity of O(n^1.98). Route matchers are evaluated against attacker-controlled URL segments during routing. Therefore, an unauthenticated attacker can trigger the vulnerable expression by sending a request to a route…
Recommended action: Upgrade to 9.1.1 or 8.2.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Route parameters are inserted into generated URLs without URI encoding. When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example: This generates the following redirect: Browsers interpret this value as an external URL and redirect the user to https://evil.example.com. Details The shared createURL() helper is used by route URL builders, including Router.makeUrl() and Response.redirect().toRoute(). Route parameter values were appended without encoding: Wildcard parameters had the same behavior: The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination. Impact An attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website. This can facilitate phishing and may be…
Recommended action: Upgrade to 9.3.0 or 8.2.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The response.redirect().back() method in @adonisjs/http-server is vulnerable to open redirects. The method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the Referer header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect'). Patches This has been fixed in @adonisjs/http-server version 8.2.0. The back() method now validates the Referer header's host against the request's own Host header. Referrers from unrecognized hosts are rejected and the redirect falls back to / (or a developer-provided fallback URL). Applications that operate across multiple domains can configure…
Recommended action: Upgrade to 8.2.0 or 7.8.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.