The AdonisJS HTTP Server package improperly neutralizes input during web page generation by interpolating error.message directly into the default HTML exception response without escaping. This occurs when debug mode is disabled and no custom status page or JSON response handles the error. An attacker can craft a missing-route URL that triggers this vulnerability, resulting in reflected cross-site scripting (CWE-79). The vulnerability affects versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2 and is resolved in versions 8.2.1 and 9.1.0.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when the victim opens a crafted missing-route URL. This can lead to information disclosure and limited integrity impact. The CVSS v3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Upgrade affected AdonisJS HTTP Server versions to 8.2.1 or later, or 9.1.0 or later, where the vulnerability is fixed. If upgrading is not immediately possible, implement custom status pages or JSON responses to handle errors instead of relying on the default HTML exception response. Patch status is not explicitly stated in the vendor advisory, but fixed versions are known.