CVE-2026-104150: AdonisJS HTTP Server DOS Vulnerability

CVE-2026-104150 Overview

CVE-2026-104150 is a Regular Expression Denial of Service (ReDoS) vulnerability in the AdonisJS HTTP Server package, which handles HTTP requests in the AdonisJS Node.js framework. The regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a crafted long slug ending in a disallowed character triggers quadratic backtracking and consumes excessive CPU. Route matching executes before route and group middleware, so authentication or rate limiting attached to the route cannot block the malicious request. The issue affects versions prior to 8.2.2 and 9.1.1.

Critical Impact
An unauthenticated attacker can block the Node.js event loop, halting the worker from serving unrelated requests and health checks.

Affected Products

AdonisJS HTTP Server versions prior to 8.2.2
AdonisJS HTTP Server versions prior to 9.1.1
AdonisJS applications using router.matchers.slug() on attacker-controlled route parameters

Discovery Timeline

2026-10-15 - CVE-2026-104150 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-104150

Vulnerability Analysis

The vulnerability is a ReDoS flaw classified under [CWE-400: Uncontrolled Resource Consumption]. The flawed regular expression /^[^\s-_](?!.*?[-_]{2,})([a-z0-9-\\]{1,})[^\s]*[^-_\s]$/ contains two adjacent greedy quantifiers, ([a-z0-9-\\]{1,}) and [^\s]*, whose character classes overlap. For a long input that ultimately fails the trailing [^-_\s]$ assertion, the regex engine redistributes characters between the two groups across many combinations. The number of backtracking paths grows quadratically with input length, forcing the single-threaded Node.js event loop to spend extended CPU time on one request.

Because route matching runs before middleware stages, protective layers such as authentication, authorization, and rate limiting are bypassed. A single unauthenticated HTTP request can stall the worker process, preventing it from responding to other clients or liveness probes.

Root Cause

The root cause is unsafe regex design in src/router/matchers.ts. Adjacent repetitions over overlapping character sets combined with a failing anchor create catastrophic backtracking, a classic ReDoS pattern.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to any route that uses router.matchers.slug() on an attacker-controlled parameter, supplying a long slug that ends in a character rejected by the final anchor (for example, a trailing hyphen or underscore).

typescript

// Security patch in src/router/matchers.ts (fix(router): prevent ReDoS in slug matcher)
   * @returns Route matcher configuration for slug values
   */
  slug() {
-   return { match: /^[^\s-_](?!.*?[-_]{2,})([a-z0-9-\\]{1,})[^\s]*[^-_\s]$/ }
+   return { match: /^[^\s_-](?=[a-z0-9\\-])(?=.{2})(?:[^\s_-]|[-_][^\s_-])+$/ }
  }
}
// Source: https://github.com/adonisjs/http-server/commit/86af38ca861528f673dcac6a4806197de038d1f7

The patched expression replaces the two overlapping greedy groups with lookahead assertions and a single non-overlapping alternation (?:[^\s_-]|[-_][^\s_-])+, eliminating ambiguous backtracking.

Detection Methods for CVE-2026-104150

Indicators of Compromise

HTTP requests to routes using slug parameters containing unusually long path segments, often several kilobytes.
Request path segments ending in disallowed characters such as -, _, or whitespace while still exceeding typical slug length.
Spikes in Node.js worker CPU utilization correlated with individual inbound requests.
Health check and liveness probe timeouts without a corresponding infrastructure failure.

Detection Strategies

Inspect application dependency manifests for @adonisjs/http-server versions below 8.2.2 or 9.1.1.
Deploy a Web Application Firewall rule to flag or drop slug path segments exceeding a defined length (for example 100 characters).
Instrument request handling with event loop lag metrics and alert on sustained lag above a safe threshold.
Audit route definitions for uses of router.matchers.slug() on parameters sourced from untrusted input.

Monitoring Recommendations

Monitor per-request latency and CPU time to surface outlier requests consistent with ReDoS behavior.
Correlate access logs with worker restarts, OOM signals, and dropped health checks.
Enable structured HTTP logging to retain full URL paths for forensic review of long or malformed slugs.

How to Mitigate CVE-2026-104150

Immediate Actions Required

Upgrade @adonisjs/http-server to version 8.2.2 or 9.1.1 immediately in all environments.
Enforce an upstream request path length limit at the reverse proxy, load balancer, or WAF layer.
Temporarily replace router.matchers.slug() with a stricter custom matcher that caps slug length until the patch is deployed.
Review all routes using slug matchers and confirm whether the parameter is attacker-controlled.

Patch Information

The maintainers released fixes in AdonisJS HTTP Server v8.2.2 and AdonisJS HTTP Server v9.1.1. Details are documented in GitHub Security Advisory GHSA-524c-h47v-m3h8, with code changes in commit 86af38c and commit d8c749a.

Workarounds

Define a route-level validation rule that rejects slug parameters above a safe maximum length before the regex evaluates.
Front the application with a reverse proxy such as Nginx or an API gateway that enforces URL and path segment size limits.
Run multiple Node.js worker processes behind a load balancer to reduce single-worker outage impact while patching.

bash

# Nginx configuration example to cap request URI length and path size
http {
    large_client_header_buffers 4 2k;
    client_header_buffer_size 1k;

    server {
        location ~ "^/.*/[A-Za-z0-9_-]{100,}/?$" {
            return 414;
        }
    }
}