CVE-2026-104150

Name of the Vulnerable Software and Affected Versions AdonisJS HTTP Server versions prior to 8.2.2 AdonisJS HTTP Server versions prior to 9.1.1

Description A Regular Expression Denial of Service (ReDoS) exists in the built-in slug route matcher. The regular expression used by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When a long string ending in a character rejected by the final assertion is applied to an attacker-controlled route parameter, it causes quadratic backtracking and excessive CPU consumption. Because route matching occurs before route and group middleware, authentication or rate-limiting measures may not prevent an unauthenticated request from blocking the Node.js event loop, stopping the worker from serving other requests or health checks.

Recommendations Update to version 8.2.2 or later. Update to version 9.1.1 or later. As a temporary workaround, avoid using the router.matchers.slug() matcher on route parameters reachable by untrusted users.