Skip to content
OpenAdvisories

Vendor

koajs

6 known vulnerabilities.

Products

koa 5 cors 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-27959 Public exploit

    Koa has Host Header Injection via `ctx.hostname`

    Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC …

    koajs koa koa npm
  • High 8.6
    CVE-2023-49803

    @koa/cors has overly permissive origin policy

    @koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that if an allowed origin is not provided, it will return an `Access-Control-Allow-Origin` header with t…

    koajs cors @koa/cors npm