{"id":"GHSA-6qvv-pj99-48qm","summary":"@adonisjs/http-server has an Open Redirect vulnerability","details":"### Impact\n\nThe `response.redirect().back()` method in `@adonisjs/http-server` is vulnerable to open redirects. The method reads the `Referer` header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the `Referer` header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site.\n\nThis affects all AdonisJS applications that use `response.redirect().back()` or `response.redirect('back')`.\n\nThe vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect').\n\n### Patches\n\nThis has been fixed in `@adonisjs/http-server` version **8.2.0**. The `back()` method now validates the `Referer` header's host against the request's own `Host` header. Referrers from unrecognized hosts are rejected and the redirect falls back to `/` (or a developer-provided fallback URL).\n\nApplications that operate across multiple domains can configure additional trusted hosts via the `redirect.allowedHosts` option in `config/app.ts`.\n\nUsers should upgrade to `@adonisjs/http-server@^8.2.0` (or `@adonisjs/core@^7.4.0` if using the core meta-package).\n\n### Workarounds\n\nIf upgrading is not immediately possible, avoid using `response.redirect().back()` in routes that are reachable by unauthenticated users or from pages that accept external traffic. Instead, redirect to a known safe path explicitly using `response.redirect().toPath('/dashboard')`.\n\n### References\n\n- [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)\n- [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)","aliases":["CVE-2026-40255"],"modified":"2026-05-05T16:02:42.354824Z","published":"2026-04-14T20:01:28Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-04-14T20:01:28Z","nvd_published_at":"2026-04-16T23:16:33Z","cwe_ids":["CWE-601"]},"references":[{"type":"WEB","url":"https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40255"},{"type":"WEB","url":"https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"},{"type":"PACKAGE","url":"https://github.com/adonisjs/http-server"},{"type":"WEB","url":"https://github.com/adonisjs/http-server/releases/tag/v7.8.1"},{"type":"WEB","url":"https://github.com/adonisjs/http-server/releases/tag/v8.2.0"}],"affected":[{"package":{"name":"@adonisjs/http-server","ecosystem":"npm","purl":"pkg:npm/%40adonisjs/http-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0-next.0"},{"fixed":"8.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-6qvv-pj99-48qm/GHSA-6qvv-pj99-48qm.json"}},{"package":{"name":"@adonisjs/core","ecosystem":"npm","purl":"pkg:npm/%40adonisjs/core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-6qvv-pj99-48qm/GHSA-6qvv-pj99-48qm.json"}},{"package":{"name":"@adonisjs/http-server","ecosystem":"npm","purl":"pkg:npm/%40adonisjs/http-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.8.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-6qvv-pj99-48qm/GHSA-6qvv-pj99-48qm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}