{"id":"CVE-2026-40255","aliases":["GHSA-6qvv-pj99-48qm"],"url":"https://o3.security/vulnerability/CVE-2026-40255","summary":"@adonisjs/http-server has an Open Redirect vulnerability","details":"### Impact\n\nThe `response.redirect().back()` method in `@adonisjs/http-server` is vulnerable to open redirects. The method reads the `Referer` header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the `Referer` header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site.\n\nThis affects all AdonisJS applications that use `response.redirect().back()` or `response.redirect('back')`.\n\nThe vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect').\n\n### Patches\n\nThis has been fixed in `@adonisjs/http-server` version **8.2.0**. The `back()` method now validates the `Referer` header's host against the request's own `Host` header. Referrers from unrecognized hosts are rejected and the redirect falls back to `/` (or a developer-provided fallback URL).\n\nApplications that operate across multiple domains can configure additional trusted hosts via the `redirect.allowedHosts` option in `config/app.ts`.\n\nUsers should upgrade to `@adonisjs/http-server@^8.2.0` (or `@adonisjs/core@^7.4.0` if using the core meta-package).\n\n### Workarounds\n\nIf upgrading is not immediately possible, avoid using `response.redirect().back()` in routes that are reachable by unauthenticated users or from pages that accept external traffic. Instead, redirect to a known safe path explicitly using `response.redirect().toPath('/dashboard')`.\n\n### References\n\n- [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)\n- [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)","published":"2026-04-16T22:25:38.155Z","modified":"2026-10-28T02:30:26.326941407Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@adonisjs/http-server","fixedVersion":"8.2.0"},{"ecosystem":"npm","name":"@adonisjs/core","fixedVersion":"7.3.1"},{"ecosystem":"npm","name":"@adonisjs/http-server","fixedVersion":"7.8.1"}],"fix":{"url":"https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08","label":"adonisjs/http-server@2008fb6"},"references":[{"type":"WEB","url":"https://github.com/adonisjs/http-server/releases/tag/v7.8.1"},{"type":"WEB","url":"https://github.com/adonisjs/http-server/releases/tag/v8.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40255.json"},{"type":"ADVISORY","url":"https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40255"},{"type":"FIX","url":"https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08"},{"type":"PACKAGE","url":"https://github.com/adonisjs/http-server"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:26.326941407Z"}}