Open redirect via unencoded route parameters in @adonisjs/http-server (CVE-2026-107718)

What happened

The package @adonisjs/http-server used a shared createURL() helper (used by Router.makeUrl() and Response.redirect().toRoute()) that inserted route parameter values into URLs without calling encodeURIComponent. If an application puts attacker-controlled data into a dynamic first path segment and then redirects to the generated route URL, a value beginning with a slash can lead to a scheme-relative external URL and an open redirect. Wildcard parameters are also affected; APIs that intentionally accept complete redirect URLs are not affected.

Technical cause

The root cause is missing URL-encoding of route parameter values in the shared createURL() helper. That missing encodeURIComponent call allowed raw parameter text (including a leading slash) to be inserted into generated URLs, enabling creation of external redirect targets from values supplied by an application.

Why it matters

An attacker able to influence a dynamic first path segment in affected applications can cause users to be redirected from a trusted site to an attacker-controlled site. This can facilitate phishing and abuse of authentication or OAuth flows. The issue is classified under CWE-601 (Open Redirect).

Who is affected

Applications that use @adonisjs/http-server and place untrusted data into a dynamic first path segment of generated route URLs are at risk. The advisory lists two affected code lines: a range introduced at version "0" and fixed in "8.2.3", and a separate range introduced at "9.0.0" and fixed in "9.3.0"—see affected versions below.

Discovery and timeline

The vulnerability was published in the OSV and NVD entries linked below on 2026-10-08 and the advisory record was updated on 2026-10-09.

Affected versions

Two affected ranges are reported for @adonisjs/http-server: introduced at "0" and fixed in "8.2.3"; and introduced at "9.0.0" and fixed in "9.3.0". Use the range that corresponds to the branch you run.

Fixes and mitigation

Vendor fixes are available: the issue is fixed in "8.2.3" and in "9.3.0" for the respective affected ranges. The advisory marks a fix as available.

Recommended action

Update @adonisjs/http-server to the vendor-fixed release that applies to your deployment ("8.2.3" or "9.3.0"). If you cannot update immediately, avoid placing untrusted values into a dynamic first path segment used to generate redirect URLs, and ensure route parameters are encoded or validated before use.