Skip to content
OpenAdvisories

Package · npm

koa

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-27959 Public exploit

    Koa has Host Header Injection via `ctx.hostname`

    Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC …

    koajs koa koa npm
  • Critical 9.2
    CVE-2025-25200 Public exploit

    Koa has Inefficient Regular Expression Complexity

    Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out …

    koajs koa koa npm