The vulnerability arises when the AdonisJS HTTP Server exception handler inserts the unescaped error.message into the default HTML error page, allowing a crafted missing‑route URL to execute attacker‑controlled JavaScript in the victim’s browser. Based on the description, this can lead to malicious script execution within the client context, potentially resulting in session hijacking or data theft.

AdonisJS HTTP Server versions 8.0.0‑next.0 through 8.2.0 and 9.0.0 through 9.0.2 are affected; the issue is fixed in 8.2.1 and 9.1.0.

The CVSS score of 6.1 reflects moderate severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation at present; the vulnerability is not listed in the CISA KEV catalog, suggesting limited real‑world exploitation. Attackers can trigger the flaw by sending a crafted HTTP request to a non‑existent route when the application is in production mode with debug disabled and no custom error page configured, thereby enabling reflected cross‑site scripting.