Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-j3bq-z7me-zbaf
Vulnerability ID VCID-j3bq-z7me-zbaf
Aliases CVE-2026-40255
GHSA-6qvv-pj99-48qm
Summary AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-40255
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-40255
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-40255
cvssv3.1 6.1 https://github.com/adonisjs/http-server
generic_textual MODERATE https://github.com/adonisjs/http-server
cvssv3.1 6.1 https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08
generic_textual MODERATE https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08
ssvc Track https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08
cvssv3.1 6.1 https://github.com/adonisjs/http-server/releases/tag/v7.8.1
generic_textual MODERATE https://github.com/adonisjs/http-server/releases/tag/v7.8.1
ssvc Track https://github.com/adonisjs/http-server/releases/tag/v7.8.1
cvssv3.1 6.1 https://github.com/adonisjs/http-server/releases/tag/v8.2.0
generic_textual MODERATE https://github.com/adonisjs/http-server/releases/tag/v8.2.0
ssvc Track https://github.com/adonisjs/http-server/releases/tag/v8.2.0
cvssv3.1 6.1 https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm
cvssv3.1_qr MODERATE https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm
generic_textual MODERATE https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm
ssvc Track https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-6qvv-pj99-48qm
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2026-40255
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-40255
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-40255
https://github.com/adonisjs/http-server
https://nvd.nist.gov/vuln/detail/CVE-2026-40255
2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08 https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08
GHSA-6qvv-pj99-48qm https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm
GHSA-6qvv-pj99-48qm https://github.com/advisories/GHSA-6qvv-pj99-48qm
v7.8.1 https://github.com/adonisjs/http-server/releases/tag/v7.8.1
v8.2.0 https://github.com/adonisjs/http-server/releases/tag/v8.2.0
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/adonisjs/http-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-17T18:42:55Z/ Found at https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/adonisjs/http-server/releases/tag/v7.8.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-17T18:42:55Z/ Found at https://github.com/adonisjs/http-server/releases/tag/v7.8.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/adonisjs/http-server/releases/tag/v8.2.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-17T18:42:55Z/ Found at https://github.com/adonisjs/http-server/releases/tag/v8.2.0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-17T18:42:55Z/ Found at https://github.com/adonisjs/http-server/security/advisories/GHSA-6qvv-pj99-48qm
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-40255
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01565
EPSS Score 0.00011
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:53:06.232675+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/40xxx/CVE-2026-40255.json 38.6.0