adonisjs

Products

ProductCVEsExploitedLatest
core4–Jul 15, 2026
http-server4–Oct 15, 2026
http-core1–Apr 16, 2026
lucid1–Jan 13, 2026

Exploited and recent CVEs

  • CVE-2026-104150 High 8.7 AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity 0.4%
  • CVE-2026-107718 Medium 6.1 AdonisJS: Unencoded route parameters can produce open redirects 0.3%
  • CVE-2026-61526 Medium 6.1 AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler 0.3%
  • CVE-2026-48795 High 8.6 Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser 0.5%
  • CVE-2026-40255 Medium 6.1 @adonisjs/http-server has an Open Redirect vulnerability 0.2%
  • CVE-2026-40255 Medium 6.1 @adonisjs/http-server has an Open Redirect vulnerability 0.2%
  • CVE-2026-25762 High 7.5 AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection 0.5%
  • CVE-2026-25754 High 7.2 AdonisJS multipart body parsing has Prototype Pollution issue 0.4%
  • CVE-2026-22814 High 8.2 Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State 0.5%
  • CVE-2026-21440 Critical 9.2 AdonisJS Path Traversal in Multipart File Handling 1.0%