PT-2026-32977 · Npm · @Adonisjs/Http-Server+1
Thetutlage
·
Published
2026-04-14
·
Updated
2026-04-17
·
CVE-2026-40255
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
@adonisjs/http-server versions prior to 7.8.1
@adonisjs/http-server versions 8.0.0-next.0 through 8.1.3
@adonisjs/core versions prior to 7.4.0
Description
The
response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all applications using response.redirect().back() or response.redirect('back').Recommendations
Update @adonisjs/http-server to version 7.8.1 or later.
Update @adonisjs/http-server to version 8.2.0 or later.
Update @adonisjs/core to version 7.4.0 or later.
As a temporary workaround, avoid using the
response.redirect().back() method in routes reachable by unauthenticated users or external traffic, and instead use response.redirect().toPath() to redirect to a known safe path.
Configure additional trusted hosts via the redirect.allowedHosts option in config/app.ts for applications operating across multiple domains.Fix
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Adonisjs/Core
@Adonisjs/Http-Server