AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and
    9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with
    overlapping character classes. When an application applies this matcher to an attacker-controlled route
    parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking
    and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-
    limiting middleware attached to the route may not prevent an unauthenticated request from blocking the
    Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is
    fixed in versions 8.2.2 and 9.1.1. (CVE-2026-104150)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and     9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with     overlapping character classes. When an application applies this matcher to an attacker-controlled route     parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking     and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-     limiting middleware attached to the route may not prevent an unauthenticated request from blocking the     Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is     fixed in versions 8.2.2 and 9.1.1. (CVE-2026-104150)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474719	SCA: security update for @adonisjs/http-server (GHSA-524c-h47v-m3h8)	Tenable Cloud Security	SCA Checks	Local	high
474719	SCA: security update for @adonisjs/http-server (GHSA-524c-h47v-m3h8)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
366355	Linux Distros Unpatched Vulnerability : CVE-2026-104150	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-104150

high

Tenable Plugins

high

high

high