CVE-2026-40255: AdonisJS HTTP Server CSRF Vulnerability

CVE-2026-40255 Overview

CVE-2026-40255 is an Open Redirect vulnerability affecting the AdonisJS HTTP Server package, a core component responsible for handling HTTP requests in the AdonisJS framework. The vulnerability exists in the response.redirect().back() method, which reads the Referer header from incoming HTTP requests and redirects users to the specified URL without validating the host. This allows attackers who can influence the Referer header to redirect users to malicious external sites, potentially enabling phishing attacks, credential theft, or malware distribution.

Critical Impact
All AdonisJS applications using response.redirect().back() or response.redirect('back') are vulnerable to open redirect attacks that could redirect users to malicious external domains.

Affected Products

@adonisjs/http-server versions prior to 7.8.1
@adonisjs/http-server versions 8.0.0-next.0 through 8.1.3
@adonisjs/core versions prior to 7.4.0

Discovery Timeline

2026-04-16 - CVE CVE-2026-40255 published to NVD
2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-40255

Vulnerability Analysis

This Open Redirect vulnerability (CWE-601) occurs because the AdonisJS HTTP Server fails to validate the host portion of URLs provided in the HTTP Referer header before performing redirects. When developers use the response.redirect().back() method to redirect users to their previous page, the framework trusts the Referer header value implicitly without checking whether the destination URL belongs to the application's domain or an approved list of hosts.

The vulnerability affects a common web application pattern where users are redirected back to their previous location after completing an action (such as login or form submission). Because the Referer header can be manipulated by attackers through crafted links or malicious pages, this creates a vector for redirecting unsuspecting users to attacker-controlled domains.

Root Cause

The root cause is insufficient validation of user-controlled redirect destinations. The original implementation directly used the Referer header value without implementing host verification. The framework lacked a mechanism to validate whether redirect URLs were relative paths (safe) or absolute URLs pointing to allowed hosts only.

Attack Vector

An attacker exploits this vulnerability by crafting a malicious link that, when clicked by a victim, sets a controlled Referer header pointing to an attacker's domain. When the victim's request reaches an AdonisJS endpoint that uses response.redirect().back(), the application redirects the user to the attacker's malicious site. This can be leveraged for phishing attacks where the malicious site mimics the legitimate application to harvest credentials.

typescript

// Security patch in src/helpers.ts - isValidRedirectUrl helper function
// Source: https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08

export { createURL }

/**
 * Validates that a URL is safe to use as a redirect destination.
 *
 * - Relative URLs must start with `/` and not be protocol-relative (`//`)
 * - Absolute URLs must parse successfully and their host must match
 *   `currentHost` or be listed in `allowedHosts`
 *
 * When `currentHost` and `allowedHosts` are omitted, absolute URLs
 * are accepted as long as they parse successfully.
 *
 * @param url - The URL to validate
 * @param currentHost - The current request's Host header value
 * @param allowedHosts - Array of additionally allowed hosts
 */
export function isValidRedirectUrl(
  url: string,
  currentHost?: string,
  allowedHosts?: string[]
): boolean {
  if (typeof url !== 'string' || url.trim() === '') {
    return false
  }

  if (url.startsWith('//')) {
    return false
  }

Source: GitHub Commit Details

Detection Methods for CVE-2026-40255

Indicators of Compromise

Unusual redirect responses (HTTP 302/301) with Location headers pointing to external domains not associated with your application
Web server logs showing requests with suspicious or external Referer header values followed by redirect responses
User reports of being redirected to unexpected or malicious websites after interacting with application links

Detection Strategies

Audit application code for usage of response.redirect().back() or response.redirect('back') methods
Review web application firewall (WAF) logs for patterns of open redirect exploitation attempts
Implement monitoring for redirect responses that contain external domain URLs in the Location header
Scan application dependencies to identify vulnerable versions of @adonisjs/http-server and @adonisjs/core

Monitoring Recommendations

Configure alerts for HTTP redirect responses pointing to domains outside your organization's approved list
Monitor for spikes in traffic originating from external referrers that result in redirect responses
Implement logging of all redirect destinations to facilitate forensic analysis

How to Mitigate CVE-2026-40255

Immediate Actions Required

Update @adonisjs/http-server to version 7.8.1 or 8.2.0 immediately
Update @adonisjs/core to version 7.4.0 or later
Audit all application routes that use response.redirect().back() or response.redirect('back') methods
Consider implementing an allowlist of permitted redirect destinations as an additional layer of defense

Patch Information

The vulnerability has been fixed in the following versions:

@adonisjs/http-server version 7.8.1 - GitHub Release v7.8.1
@adonisjs/http-server version 8.2.0 - GitHub Release v8.2.0
@adonisjs/core version 7.4.0

The fix introduces the isValidRedirectUrl helper function that validates redirect destinations by ensuring relative URLs start with / and are not protocol-relative (//), and that absolute URLs match the current host or are listed in an explicitly defined allowedHosts array. For detailed patch information, see the GitHub Security Advisory GHSA-6qvv-pj99-48qm.

Workarounds

Avoid using response.redirect().back() or response.redirect('back') until patched versions can be deployed
Implement custom middleware to validate the Referer header against an allowlist of trusted domains before processing redirect requests
Replace dynamic redirect-back functionality with explicit redirect URLs to known safe destinations within your application

bash

# Update AdonisJS packages to patched versions
npm update @adonisjs/http-server@7.8.1
npm update @adonisjs/core@7.4.0

# Or for AdonisJS 8.x
npm update @adonisjs/http-server@8.2.0