The AdonisJS HTTP Server package contains a regular expression used by router.matchers.slug() that has overlapping greedy repetitions. When an attacker supplies a specially crafted path segment, the regex performs quadratic backtracking, consuming excessive CPU time and blocking the Node.js event loop. This can stop the worker from serving other requests or health checks, effectively creating a denial‑of‑service condition. The issue is triggered before any authentication or rate‑limiting middleware runs, so it can be exploited by unauthenticated users. The root weakness corresponds to CWE‑1333 (Array Indexing) and CWE‑400 (Uncontrolled Resource Consumption).

All applications that use the AdonisJS HTTP Server package earlier than version 8.2.2 or 9.1.1 are impacted. The software originates from the adonisjs:http-server project and is deployed within projects built on the AdonisJS framework. No other vendors or product versions are currently identified as affected.

The vulnerability scored 8.7 on the CVSS v3 scale, indicating high severity. EPSS data is presently not available, and the flaw has not been listed in the CISA KEV catalog, but the exploit potential remains high because it can be triggered by plain HTTP requests. An attacker with network access to the application can send crafted URLs that overflow the regular expression engine, causing sustained CPU usage and a denial of service. Because the attack occurs before any authentication or limiting middleware, it requires no privileged access and can be executed from any untrusted source.