AdonisJS: ReDoS via uncontrolled regex complexity (CVE-2026-104150)

A crafted slug can make the affected AdonisJS matcher consume excessive CPU and stall request processing. Apply the appropriate release update to protect service availability.

Public CVE record · Native module source

cve.now entry. The experiment used a synthetic HTTP fixture.

Eden terminates the HTTP connection to the affected product, evaluates a declarative policy and — in tier 2 — a separately compiled native Rust module under signed module authority, before any byte reaches the application. It does not patch the affected component; the vendor's fixed release remains the durable repair.

Status: Two-tier lab fixture comparison recorded. The fixture ran against Eden 1.103.0.

Module source

The vulnerability

AdonisJS routes with unbounded regular expressions catastrophically backtrack on crafted parameters (high, 8.7). The fixture reproduces the delivery shape: an overlong search parameter records a ReDoS mark.

The Eden patch

Tier 1 — declarative policy (blunt, fail-closed): deny every request under /search (non-slash scope), legitimate traffic included — false positives measured below.

Tier 2 — native Rust module gabriel_adonisredos_v1 (surgical): refuses search targets whose query parameters exceed 256 bytes

Implement the remediation

The commands are operator examples for the recorded scope. Compare fixture routes and software selectors with the intended deployment before use. See deployment prerequisites.

1. Prepare the target. Verify the loaded product and version against the advisory. Use a compatible Eden HTTP interlay and an authenticated operator with Configure permission. Use this reconstruction of the report’s scoped fixture deny.
2. Apply the declarative policy. Scope the policy to /search and descendants (all methods, deny). Set INTERLAY to the target interlay UUID in the authenticated Eden CLI. Run an authenticated GET /api/v1/interlays/{interlay} with X-Eden-Verbose: true. Save its complete current settings object as current-settings.json and retain the prior remediation declaration for recovery. Set IDEMPOTENCY_KEY to a fresh key for this intended mutation.

Save the declaration as remediation.json.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/search",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

jq -e --slurpfile policy remediation.json \
  '.remediation = $policy[0] | {settings: .}' current-settings.json \
  > interlay-update.json
eden api request PATCH "/api/v1/interlays/$INTERLAY" \
  --header "Idempotency-Key:$IDEMPOTENCY_KEY" \
  --body-file interlay-update.json --content-type application/json --confirm

3. Verify the serving policy. Read back the interlay.

eden api request GET "/api/v1/interlays/$INTERLAY" \
  --header 'X-Eden-Verbose:true'

Check that remediation_status.state is ready and both desired and effective SHA-256 values match the intended declaration. Replay the benign and marked requests in the recorded comparison on an isolated target. Check the recorded response and backend outcome for each probe. 4. Restore the previous policy. Coordinate the change with any other operator updating this interlay. Read current settings again and merge the saved remediation field into them. If the prior settings had no remediation field, omit it in the replacement. Send the same PATCH with a fresh idempotency key, then read back the intended state. Repeat the verification probes. Keep the affected route isolated if restoring the prior settings reopens exposure.

Native module gabriel_adonisredos_v1

1. Prepare the archive. Use the linked source and a compatible Eden SDK. Obtain the built archive and manifest from a qualified Eden build environment. Configure independent host approval for the installed Eden release. Use the authenticated principals required by the native authority contract. Set PATCH_ARCHIVE to the exact schema-2 package and PACKAGE_SHA256 to its expected archive digest. Verify and import it using the same target interlay.

printf '%s  %s\n' "$PACKAGE_SHA256" "$PATCH_ARCHIVE" | sha256sum --check &&
  eden api request PUT "/api/v1/interlays/$INTERLAY/patch-packages/$PACKAGE_SHA256" \
    --body-file "$PATCH_ARCHIVE" \
    --content-type application/vnd.eden.patch-package.v2+tar --confirm

2. Approve and activate. Enroll the publisher key, attest host software inventory, and inspect the configuration returned by import. Obtain independent host approval. Sign the typed statement with the matching SDK. Send the admit action followed by activate for the prepared operation. Use the applicable typed payload for each action in authority-action.json.

eden api request POST "/api/v1/interlays/$INTERLAY/native-authority" \
  --body-file authority-action.json --content-type application/json --confirm

3. Verify the operation. Read the receipt through the same endpoint. Confirm serving_now and the full expected shard acknowledgment. Repeat the report’s benign and marked probes and check the backend observations.
4. Revoke or restore. Send revoke with the exact operation UUID. Mandatory protection can refuse traffic until a compatible operation is approved and activated. Verify the restored receipt and repeat the probes.

Vendor update. Use the advisory and its product-specific vendor references to select the fixed release for the exact installed product or package and release line. Follow its update instructions and confirm the version actually loaded by the service.

Measured comparison (2026-11-12 UTC)

Summary of measured outcomes across the full authority lifecycle (baseline → tier-1 → tier-2 → revoke → restore):

• Baseline (no remediation): benign 200, attack 200 with the primitive recorded at the fixture oracle
• Tier 1 (deny): both probes refused 403 (blunt, false positives included)
• Tier 2 (module): benign 200 / attack 403, zero backend effects

Authority lifecycle and negatives

Import 201, activation: explicit_required; publisher enroll_key, host inventory + approve, reader inspect refused 403; tampered-statement admit 400; invalid-signature admit 403; admit prepared (not serving), activate → receipt serving_now, all expected shards acknowledged the operation. Revoke → the identical attack gets 503 (fail-closed); re-approve + re-activate → 403 again.

Test scope

The fixture reproduces the delivery shape with a harmless marker effect, not the full product surface. Bypass variants (encodings, alternate routes, sibling entry points) are not bypass-tested; the rule is a lab-grade partial by construction.

Performance trace (Eden telemetry)

Measured with Eden's built-in request telemetry (gateway.request.baseline spans, read back through /api/v1/analytics/telemetry?signal=traces), not client wall-clock. Latency Eden introduces per remediation arm for this case:

Eden-added latency for the tier-2 remediation: benign requests complete in 379 µs mean (p50 357 µs, p95 548 µs) in-product, module evaluation included. Honest scope: lab fixtures on one host, fresh connection per measured request; module reactivated with a fresh signed statement per measurement; spans carry the full authority lineage (module SHA-256, operation, publication).

Evidence and artifacts

• Public CVE record
• Published module source