Skip to content
OpenAdvisories
Critical · 9.2 Public exploit CVE-2025-25200 EUVD-2025-4086GHSA-593f-38f6-jp5m

Koa has Inefficient Regular Expression Complexity

Published Feb 12, 2025 · Updated Feb 12, 2025 · Assigned by GitHub_M

Vendor: koajs Product: koa Package: koa Ecosystem: npm

Description

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.

Affected products

VendorProductAffectedFixed
koajs koa < 0.21.2, >= 1.0.0, < 1.7.1, >= 2.0.0-alpha.1, < 2.15.4, >= 3.0.0-alpha.0, < < 3.0.0-alpha.3 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm koa >= 2.0.0, < 2.15.4 2.15.4 GHSA-593f-38f6-jp5m
npm koa >= 3.0.0-alpha.0, < 3.0.0-alpha.3 3.0.0-alpha.3 GHSA-593f-38f6-jp5m
npm koa >= 1.0.0, < 1.7.1 1.7.1 GHSA-593f-38f6-jp5m
npm koa < 0.21.2 0.21.2 GHSA-593f-38f6-jp5m

References