apollo-koa-minimal

CVE-2023-26144...

EUVD-2026-66388

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

ROOT-APP-NPM-CVE-2025-25200 CVE-2025-25200 in koa - Patched by Root

Root has patched CVE-2025-25200 in the koa package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27959 CVE-2026-27959 in koa - Patched by Root

Root has patched CVE-2026-27959 in the koa package for Root:npm. Multiple fixed versions available...

UBUNTU-CVE-2026-88038

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

CVE-2026-88038: Improper Neutralization of Special Elements in Output Used by a Downstream Component

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

CLSA-2026-1788264598 TuxCare security update for koa (1 CVE)

TuxCare rebuilt koa to address 1 CVE. Fixed in 1.7.1-tuxcare.3...

CVE-2026-80349

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349

TarsWeb through 3.0.14 contains a critical authentication bypass (CVSS 9.8). The root cause is a combination of two misconfigurations: Koa's proxy option is set to true without restricting trusted upstream proxies, so the source address is taken from the caller-controlled X-Forwarded-For header; ...

CLSA-2026-1787657292 TuxCare security update for koa (4 CVEs)

TuxCare rebuilt koa to address 4 CVEs. Fixed in 2.15.3-tuxcare.1...

Exploit for Injection in Budibase

CVE-2026-31816 — Budibase Authentication Bypass → RCE !CVE...

CLSA-2026-1774830253 TuxCare security update for koa (1 CVE)

TuxCare rebuilt koa to address 1 CVE. Fixed in 1.7.1-tuxcare.1...

The vulnerability of the Node.js web framework Koa allows attackers to compromise the integrity of protected information.

The vulnerability of the Node.js Koa web framework is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

ROOT-APP-NPM-CVE-2025-32379 CVE-2025-32379 in @rootio/koa - Patched by Root

Root has patched CVE-2025-32379 in the @rootio/koa package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-8129 CVE-2025-8129 in @rootio/koa - Patched by Root

Root has patched CVE-2025-8129 in the @rootio/koa package for Root:npm. Multiple fixed versions available...

MAL-2026-6025 Malicious code in @mastra/koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0e8ae2c317dbb57c6a85b0bea50cddd76d109cd8ec802bc646df6c514d91bcd The bundled output at dist/index.cjs:212 and dist/index.js:210 contains a Buffer.from..., 'base64'.toString'utf-8' pattern. Base64 decoding into a...