CVE-2026-40255 adonisjs CVE debrief

Who should care

Defenders of AdonisJS applications that use response.redirect().back() or response.redirect('back') should assess exposure and prioritize updating to versions 7.8.1 or 8.2.0 of @adonisjs/core.

Why it matters

CVE-2026-40255 is a vulnerability in AdonisJS HTTP Server that allows an attacker to redirect users to a malicious external site by influencing the Referer header. Defenders should prioritize verifying and updating affected applications to prevent potential redirects.

• Potential redirects to malicious sites
• Need to verify and update affected applications
• Possible exploitation through Referer header manipulation

Technical summary

The response.redirect().back() method in AdonisJS HTTP Server reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host. This allows an attacker to redirect users to a malicious external site. The issue has been fixed in versions 7.8.1 and 8.2.0 of @adonisjs/core. Defenders should prioritize verifying and updating affected AdonisJS applications to prevent potential redirects to malicious sites. Affected applications should review user input for Referer header manipulation.

Defensive priority

Defenders should prioritize verifying and updating affected AdonisJS applications to prevent potential redirects to malicious sites.

Recommended defensive actions

• Verify and update affected AdonisJS applications to versions 7.8.1 or 8.2.0 of @adonisjs/core
• Review and validate user input for Referer header
• Implement additional security measures to prevent redirects to malicious sites
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability affects AdonisJS applications using response.redirect().back() or response.redirect('back'). The issue is fixed in versions 7.8.1 and 8.2.0 of @adonisjs/core. Evidence is limited to public CVE details and vendor advisories. Defenders should verify affected applications and review Referer header input for potential redirects.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.