CVE-2026-104150: AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
Description
A Regular Expression Denial of Service vulnerability in the built-in AdonisJS slug route matcher may allow a remote attacker to block the Node.js event loop using a specially crafted URL.
This affects applications using router.matchers.slug() on a route parameter reachable by an attacker.
Details
The regular expression used by router.matchers.slug() contains adjacent greedy quantifiers with overlapping character classes:
regex /^^\s-([a-z0-9-\\]{1,})[^\s][^-\s]$/
When the matcher receives a long string ending with a character rejected by the final assertion, the regular expression engine must evaluate many possible ways of dividing the input between the overlapping quantifiers before determining that it does not match.
This results in quadratic execution time. Testing measured an approximate complexity of O(n^1.98).
Route matchers are evaluated against attacker-controlled URL segments during routing. Therefore, an unauthenticated attacker can trigger the vulnerable expression by sending a request to a route configured as follows:
ts router .get('/posts/:slug', handler) .where('slug', router.matchers.slug())
Routing occurs before route and group middleware. As a result, authentication or rate-limiting middleware attached to the affected route may not prevent exploitation.
The vulnerability is limited to routes that explicitly use the built-in slug matcher.
Impact
Exploitation requires an application to expose a route using router.matchers.slug() with an attacker-controlled parameter.
A specially crafted request can cause excessive CPU consumption and block the Node.js event loop. While the expression is being evaluated, the process cannot serve other requests, including requests to unrelated routes or health-check endpoints.
Only a small number of requests may be required to consume the capacity of a worker. Reverse-proxy request-line limits reduce the maximum processing time of an individual request but do not fully mitigate the vulnerability.
Patches
Fixes targeting v6 and v7 have been published below.
Users should upgrade to a version that includes the following fix:
- https://github.com/adonisjs/http-server/releases/tag/v9.1.1 - https://github.com/adonisjs/http-server/releases/tag/v8.2.2
Other sources
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@adonisjs/http-serverto a version that resolves this vulnerability.Fixed in 8.2.2 - Upgrade
Upgrade
npm/@adonisjs/http-serverto a version that resolves this vulnerability.Fixed in 9.1.1 - Upgrade
Upgrade
AdonisJS HTTP Serverto a version that resolves this vulnerability.Fixed in 8.2.2 - Upgrade
Upgrade
AdonisJS HTTP Serverto a version that resolves this vulnerability.Fixed in 9.1.1 - Compensating control
Apply reverse-proxy request-line limits to reduce the maximum processing time of an individual request; this does not fully mitigate the vulnerability.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are affected when they use router.matchers.slug() on a route parameter that an attacker can reach. A route such as /posts/:slug constrained with .where('slug', router.matchers.slug()) is an exposed configuration.
Does exploitation require authentication or other privileges?
No. An unauthenticated remote attacker can trigger the issue by sending requests containing a specially crafted URL segment to a reachable route that uses the slug matcher.
What request pattern causes the most expensive processing?
The matcher exhibits quadratic execution time when given a long input string that ends in a character rejected by its final assertion. Processing such a segment can block the Node.js event loop during route matching.