CVE-2026-104150

A flaw was found in AdonisJS HTTP Server. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending an HTTP request containing a specially crafted route parameter. Due to an inefficient regular expression in the slug route matcher, evaluating the input causes excessive CPU consumption and blocks the application event loop, preventing the server from handling legitimate requests.

Important impact is assigned to this flaw because a remote unauthenticated actor can stall the single-threaded Node.js runtime with minimal request volume, completely disrupting the application worker from servicing benign traffic and health monitoring probes. The severity is heightened because path resolution executes prior to route and group middleware, preventing standard rate-limiting or authentication controls from intervening before regex evaluation. However, exposure only affects deployments where services explicitly bind the optional built-in slug parameter matcher to untrusted route parameters.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.