PT-2026-66595 · Unknown · @Adonisjs/Http-Server

CVE-2026-61526

·

Published

2026-07-30

·

Updated

2026-07-31

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions AdonisJS HTTP Server versions 8.0.0-next.0 through 8.2.0 AdonisJS HTTP Server versions 9.0.0 through 9.0.2
Description The default HTML renderer interpolates the error.message variable directly into the HTML exception response without proper escaping when debug mode is disabled and no custom status page or JSON response is configured. This allows an attacker to execute arbitrary JavaScript in the victim's browser by providing a specially crafted missing-route URL.
Recommendations Update to version 8.2.1 or later. Update to version 9.1.0 or later.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-61526
GHSA-CWM9-GFHC-46F6

Affected Products

@Adonisjs/Http-Server