CVE-2026-61526

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61526
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61526.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61526
Aliases
  • GHSA-cwm9-gfhc-46f6
Published
2026-07-30T20:55:43.406Z
Modified
2026-08-02T03:31:53.777277212Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler
Details

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61526.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/adonisjs/http-server

Affected ranges

Type
GIT
Repo
https://github.com/adonisjs/http-server
Events
Introduced
3979d3392b75170f60e301da9cdf3742032f8088
Fixed
a7bd294cb981fb893923260767e91592766730c7
Introduced
55080684675d0ba66d829d81cbe1270b5c2eee58
Fixed
26e3c8c4b4bf000662aa91c09f38f6f2e885dc3b
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "8.0.0-next.0"
        },
        {
            "fixed": "8.2.1"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.1.0"
        }
    ]
}

Affected versions

v8.*
v8.0.0
v8.0.0-next.0
v8.0.0-next.1
v8.0.0-next.10
v8.0.0-next.11
v8.0.0-next.12
v8.0.0-next.13
v8.0.0-next.14
v8.0.0-next.15
v8.0.0-next.16
v8.0.0-next.17
v8.0.0-next.18
v8.0.0-next.19
v8.0.0-next.2
v8.0.0-next.3
v8.0.0-next.4
v8.0.0-next.5
v8.0.0-next.6
v8.0.0-next.7
v8.0.0-next.8
v8.0.0-next.9
v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.2.0
v9.*
v9.0.0
v9.0.1
v9.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61526.json"