CVE-2026-61526 Details
Description
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.
A reflected Cross-Site Scripting vulnerability has been identified in the AdonisJS HTTP Server package, specifically in versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2. The vulnerability arises because error messages are interpolated into the default HTML exception response without proper escaping. This flaw allows a crafted missing-route URL to execute attacker-controlled JavaScript when the victim opens it, provided that no custom status page or JSON response addresses the error. The issue is present when debug mode is turned off and the default HTML renderer is used, which directly incorporates error messages into the response. The vulnerability has been patched in versions 8.2.1 and 9.1.0.
Users should upgrade to AdonisJS HTTP Server version 8.2.1 or 9.1.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/adonisjs/http-server/commit/5d7465d599753b1fce8a36da18955f2c273e4f87 | [email protected] | Source CodeVendor |
| https://github.com/adonisjs/http-server/commit/71a0a8e375c375e3588ba44ef68b0ef5a993c3d3 | [email protected] | Source CodeVendor |
| https://github.com/adonisjs/http-server/releases/tag/v8.2.1 | [email protected] | Release NotesVendor |
| https://github.com/adonisjs/http-server/releases/tag/v9.1.0 | [email protected] | Release NotesVendor |
| https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AdonisJS HTTP Server | >= 8.0.0, <= 8.2.0 (semver) >= 9.0.0, <= 9.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |