Skip to content
OpenAdvisories

Package · npm

koa

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-27959 Public exploit

    Koa has Host Header Injection via `ctx.hostname`

    Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC …

    koajs koa koa npm