CVE-2026-104150
Description
A flaw was found in AdonisJS HTTP Server. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending an HTTP request containing a specially crafted route parameter. Due to an inefficient regular expression in the slug route matcher, evaluating the input causes excessive CPU consumption and blocks the application event loop, preventing the server from handling legitimate requests.
Statement
Important impact is assigned to this flaw because a remote unauthenticated actor can stall the single-threaded Node.js runtime with minimal request volume, completely disrupting the application worker from servicing benign traffic and health monitoring probes. The severity is heightened because path resolution executes prior to route and group middleware, preventing standard rate-limiting or authentication controls from intervening before regex evaluation. However, exposure only affects deployments where services explicitly bind the optional built-in slug parameter matcher to untrusted route parameters.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
