Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2026-27959 EUVD-2026-8816GHSA-7gcc-r8m5-44qm

Koa has Host Header Injection via `ctx.hostname`

Published Feb 26, 2026 · Updated Jul 15, 2026 · Assigned by GitHub_M

Vendor: koajs Product: koa Package: koa Ecosystem: npm

Description

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.

Affected products

VendorProductAffectedFixed
koajs koa >= 3.0.0, < 3.1.2, < 2.16.4 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm koa >= 3.0.0, < 3.1.2 3.1.2 GHSA-7gcc-r8m5-44qm
npm koa < 2.16.4 2.16.4 GHSA-7gcc-r8m5-44qm

Advisories 2

References