CVE-2026-107718: AdonisJS HTTP Server CSRF Vulnerability

CVE-2026-107718 Overview

CVE-2026-107718 is an open redirect vulnerability [CWE-601] in the AdonisJS HTTP Server package. The shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute() inserts route parameter values into generated URLs without calling encodeURIComponent. When an application places attacker-controlled data in a dynamic first path segment and uses the resulting URL as a redirect destination, a value beginning with a slash produces a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding. Attackers can leverage this to redirect users from a trusted application to an attacker-controlled site, enabling phishing and abuse of authentication or OAuth flows.

Critical Impact
Attackers can redirect authenticated users to attacker-controlled domains, facilitating credential theft and OAuth token hijacking through trusted AdonisJS applications.

Affected Products

AdonisJS HTTP Server versions prior to 8.2.3
AdonisJS HTTP Server versions prior to 9.3.0
Applications using Router.makeUrl() or Response.redirect().toRoute() with user-controlled parameters

Discovery Timeline

2026-10-08 - CVE-2026-107718 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107718

Vulnerability Analysis

The vulnerability resides in the AdonisJS HTTP Server routing helper responsible for building URLs from named routes. The createURL() function assembles URI segments by joining parameter values directly into the output string without URL-encoding them. Because the slash character is not escaped, an attacker-supplied value such as /evil.com becomes a literal path separator in the resulting URL. When the generated URL is passed to a redirect response, browsers interpret a leading double slash as a scheme-relative reference and navigate to the external host.

The issue affects both dynamic parameters and wildcard route segments. APIs that intentionally accept complete redirect URLs are not in scope because they expect fully qualified destinations. The vulnerability is classified under CWE-601: URL Redirection to Untrusted Site.

Root Cause

The helper in src/client/helpers.ts concatenated parameter values with values.join('/') and did not pass each value through encodeURIComponent. Any character with special meaning in a URL, including the forward slash, survived into the generated path. This allowed route parameters to break out of their intended path segment.

Attack Vector

Exploitation requires an application route that accepts user-controlled input as the first dynamic path segment and uses the generated URL as a redirect target. An attacker crafts a link containing a value such as //attacker.com or /\attacker.com for the parameter. The victim clicks the trusted application link, the server generates //attacker.com/..., and the browser follows the redirect to the attacker-controlled host. User interaction is required, which aligns with the phishing-oriented impact.

typescript

// Patch from src/client/helpers.ts — encode route parameters in generated URLs
       )
     }

-    uriSegments.push(`${values.join('/')}${token.end}`)
+    uriSegments.push(
+      `${values.map((value) => encodeURIComponent(String(value))).join('/')}${token.end}`
+    )
     break
   }

Source: GitHub Commit Fix

Detection Methods for CVE-2026-107718

Indicators of Compromise

HTTP 302 or 301 responses from AdonisJS applications containing Location headers beginning with // or /\ followed by an external hostname.
Access logs showing route parameters containing URL-encoded or raw slash characters immediately followed by a domain name.
Referrer logs on external domains showing inbound traffic originating from legitimate AdonisJS application routes.

Detection Strategies

Audit application source for usage of Router.makeUrl() and Response.redirect().toRoute() where parameter values originate from request input such as query strings, form fields, or headers.
Deploy web application firewall rules that inspect route parameter values for leading slashes or backslashes.
Review package manifests (package.json, package-lock.json, pnpm-lock.yaml) for @adonisjs/http-server versions below 8.2.3 or 9.3.0.

Monitoring Recommendations

Alert on outbound Location headers whose host component does not match the application's canonical domain allowlist.
Monitor authentication and OAuth callback flows for anomalous redirect targets, particularly after login or consent screens.
Correlate phishing reports with recent redirect responses from the affected application to identify active abuse.

How to Mitigate CVE-2026-107718

Immediate Actions Required

Upgrade @adonisjs/http-server to version 8.2.3 or 9.3.0 across all AdonisJS applications.
Inventory all redirect destinations derived from Router.makeUrl() or Response.redirect().toRoute() and confirm the parameter sources.
Rotate OAuth client secrets and session tokens if logs indicate exploitation attempts against authentication flows.

Patch Information

The fix is published in AdonisJS HTTP Server v8.2.3 and v9.3.0. Both patches update src/client/helpers.ts to apply encodeURIComponent to every route parameter value before joining them into the generated URL. See the GitHub Security Advisory GHSA-2m6q-8v3h-jqww for the full advisory and the upstream commit.

Workarounds

Validate route parameter values server-side to reject inputs beginning with /, \, or containing URL-reserved characters before passing them to URL generators.
Wrap redirect destinations in an allowlist check that confirms the host component matches the application's own origin.
Prefer Response.redirect() with a fixed internal path and append user-controlled identifiers only after explicit encoding and validation.

bash

# Upgrade AdonisJS HTTP Server to a patched version
npm install @adonisjs/http-server@^9.3.0
# or for the v8 line
npm install @adonisjs/http-server@^8.2.3

# Verify installed version
npm ls @adonisjs/http-server