CVE-2026-104150: 
JavaScript vulnerability analysis and mitigation

CVE-2026-104150 is a Regular Expression Denial of Service (ReDoS) vulnerability in the AdonisJS HTTP Server package (@adonisjs/http-server). The flaw exists in the router.matchers.slug() function, whose regular expression contains adjacent greedy quantifiers with overlapping character classes, enabling quadratic backtracking when processing maliciously crafted slug parameters. Affected versions are all releases prior to 8.2.2 (for AdonisJS v6) and all 9.x releases prior to 9.1.1 (for AdonisJS v7). The vulnerability was published on October 15, 2026, with patches released on July 27, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (Inefficient Regular Expression Complexity). The vulnerable regular expression in router.matchers.slug() is /^[^\s-_](?!.*?[-_]{2,})([a-z0-9-\\]{1,})[^\s]*[^-_\s]$/, which contains adjacent greedy quantifiers ([a-z0-9-\\]{1,} followed by [^\s]*) with overlapping character classes. When a long slug string ending in a character rejected by the final assertion (e.g., a trailing underscore) is evaluated, the regex engine must explore an exponential number of possible divisions between the overlapping quantifiers, resulting in approximately O(n^1.98) complexity. Because route matching occurs before any middleware is applied, an unauthenticated attacker can trigger this path simply by sending an HTTP GET request to any route configured with .where('slug', router.matchers.slug()), bypassing authentication or rate-limiting controls entirely (GitHub Advisory, Patch Commit).

Successful exploitation causes excessive CPU consumption that blocks the Node.js event loop, preventing the affected worker process from serving any requests — including requests to unrelated routes and health-check endpoints — for the duration of the regex evaluation. Only a small number of crafted requests may be sufficient to saturate a worker's capacity, effectively causing a denial of service. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment classifies the vulnerability as automatable with no known exploitation. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the attack requires no authentication, no user interaction, and low complexity — any application exposing a route with router.matchers.slug() is potentially reachable by any internet-based attacker.

1. Reconnaissance: Identify AdonisJS applications (v6 or v7) that expose routes using router.matchers.slug() on an attacker-controlled URL parameter (e.g., /posts/:slug). This can be done by probing URL patterns typical of AdonisJS applications or reviewing publicly accessible source code.
2. Craft malicious slug: Construct a long URL slug parameter consisting of a large number of valid characters (e.g., repeated lowercase letters) followed by a trailing character rejected by the final regex assertion, such as an underscore (_). Example: a string of 50,000 a characters followed by _.
3. Send HTTP request: Issue an HTTP GET request to the vulnerable route with the crafted slug as the route parameter, e.g., GET /posts/aaa...aaa_ (with tens of thousands of characters).
4. Trigger quadratic backtracking: The regex engine in router.matchers.slug() evaluates the malicious input, causing quadratic backtracking (~O(n^1.98)) and consuming excessive CPU cycles, blocking the Node.js event loop.
5. Achieve denial of service: While the regex is being evaluated, the worker process cannot serve any other requests. Repeating this with a small number of concurrent requests can fully exhaust worker capacity, causing a denial of service for all users (GitHub Advisory, Patch Commit).

• Network: Repeated HTTP GET requests to routes with slug parameters containing unusually long strings (tens of thousands of characters), particularly those ending in _ or -; requests with URL path segments significantly exceeding normal length limits.
• Logs: Application access logs showing requests to slug-parameterized routes (e.g., /posts/:slug) with extremely long parameter values; elevated response times or timeouts on these routes.
• Process: Sustained high CPU utilization on Node.js worker processes without a corresponding increase in legitimate traffic; worker processes becoming unresponsive or failing health checks during periods of normal load.

The primary remediation is to upgrade @adonisjs/http-server to version 9.1.1 (for AdonisJS v7) or 8.2.2 (for AdonisJS v6), which replace the vulnerable regex with a rewritten pattern that eliminates overlapping unbounded repetitions (v9.1.1 Release, v8.2.2 Release). As a temporary workaround, implement request-line length limits at the reverse proxy or load balancer level (e.g., Nginx large_client_header_buffers) to reduce the maximum input size processed by the vulnerable regex, though this does not fully mitigate the vulnerability. Additionally, deploying rate-limiting at the network perimeter (before requests reach the application) can reduce the impact of repeated exploitation attempts.