CVE-2026-104150: CWE-400: Uncontrolled Resource Consumption in adonisjs http-server

The AdonisJS HTTP Server package contains a regular expression in router.matchers.slug() that has adjacent greedy repetitions with overlapping character classes. When an attacker supplies a long slug ending with a character rejected by the final assertion, it triggers quadratic backtracking, leading to uncontrolled resource consumption (CPU exhaustion). Since route matching happens before middleware such as authentication or rate-limiting, an unauthenticated attacker can exploit this to block the Node.js event loop, disrupting service availability. This vulnerability is addressed in versions 8.2.2 and 9.1.1.

An attacker can cause a denial of service by sending specially crafted route parameters that trigger excessive CPU usage due to inefficient regular expression processing. This can block the Node.js event loop, preventing the server from processing legitimate requests or health checks, potentially leading to service outages. The vulnerability affects unauthenticated requests because middleware protections are applied after route matching.

Upgrade AdonisJS HTTP Server to version 8.2.2 or later, or 9.1.1 or later, where the issue is fixed. No other mitigations are indicated since the vulnerability occurs before middleware enforcement. Patch status is confirmed fixed in these versions.