CVE-2026-104150 with a CVSS score of 6.4 is a Regular Expression Denial of Service vulnerability in the built-in AdonisJS HTTP Server slug route matcher, specifically the router.matchers.slug() component used for route parameters. The flaw stems from inefficient regular expression complexity caused by adjacent greedy quantifiers with overlapping character classes, allowing a specially crafted URL to force the regular expression engine to evaluate numerous possible divisions of the input. The vulnerability affects the @adonisjs/http-server npm package. Exploitation occurs over the network when an application exposes an attacker-controlled route parameter configured with the built-in slug matcher; an unauthenticated attacker can send a request to a route such as /posts/:slug, and routing evaluates the matcher before route and group middleware, so authentication or rate-limiting middleware may not prevent exploitation. The result is excessive CPU consumption and blocking of the Node.js event loop, preventing the process from serving other requests, including unrelated routes and health-check endpoints. A small number of requests may consume worker capacity, creating denial-of-service risks and degrading service availability for business operations.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-104150 with a CVSS score of 6.4 is a Regular Expression Denial of Service vulnerability in the built-in AdonisJS HTTP Server slug route matcher, specifically the router.matchers.slug() component used for route parameters. The flaw stems from inefficient regular expression complexity caused by adjacent greedy quantifiers with overlapping character classes, allowing a specially crafted URL to force the regular expression engine to evaluate numerous possible divisions of the input. The vulnerability affects the @adonisjs/http-server npm package. Exploitation occurs over the network when an application exposes an attacker-controlled route parameter configured with the built-in slug matcher; an unauthenticated attacker can send a request to a route such as /posts/:slug, and routing evaluates the matcher before route and group middleware, so authentication or rate-limiting middleware may not prevent exploitation. The result is excessive CPU consumption and blocking of the Node.js event loop, preventing the process from serving other requests, including unrelated routes and health-check endpoints. A small number of requests may consume worker capacity, creating denial-of-service risks and degrading service availability for business operations.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]