CVE-2026-104150: AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

A Regular Expression Denial of Service vulnerability in the built-in AdonisJS slug route matcher may allow a remote attacker to block the Node.js event loop using a specially crafted URL.

This affects applications using router.matchers.slug() on a route parameter reachable by an attacker.