CVE-2026-104150 adonisjs CVE debrief

Who should care

Defenders of applications using AdonisJS HTTP Server, especially those with publicly accessible route parameters using the `router.matchers.slug()` function, should assess exposure and prioritize updates or compensating controls.

Why it matters

CVE-2026-104150 is a Regular Expression Denial of Service vulnerability in AdonisJS HTTP Server's slug route matcher. Defenders should care because it can be triggered by a remote attacker with a specially crafted URL, potentially blocking the Node.js event loop or causing high resource consumption. Priority should be given to verifying and updating affected versions, especially in applications with publicly accessible vulnerable route parameters.

• Potential blocking of the Node.js event loop by a remote attacker.
• Increased resource consumption due to inefficient regular expression complexity.
• Need for verification of affected versions and exposure in applications using the vulnerable slug route matcher.
• Priority for updating or patching vulnerable @adonisjs/http-server versions.

Technical summary

The regular expression used by `router.matchers.slug()` contains adjacent greedy quantifiers with overlapping character classes, leading to quadratic execution time when matching long strings. Testing measured an approximate complexity of O(n^1.98). Route matchers are evaluated against attacker-controlled URL segments during routing. Therefore, an unauthenticated attacker can trigger the vulnerable expression by sending a request to a route configured with the vulnerable slug route matcher. Defenders should prioritize verifying and updating affected @adonisjs/http-server versions, especially for applications using the vulnerable slug route matcher.

Defensive priority

Defenders should prioritize verifying and updating affected @adonisjs/http-server versions, especially for applications using the vulnerable slug route matcher.

Recommended defensive actions

• Verify and update @adonisjs/http-server to a fixed version (8.2.2 or 9.1.1) if using the vulnerable slug route matcher.
• Review and restrict usage of `router.matchers.slug()` on route parameters reachable by attackers.
• Monitor for and limit excessive URL requests that could trigger the vulnerable expression.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by a regular expression with adjacent greedy quantifiers and overlapping character classes in the `router.matchers.slug()` function. Testing measured an approximate complexity of O(n^1.98).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.