Denial Of Service (DoS)

Koa is vulnerable to Denial of Service. The vulnerability is due to inefficient regular expression processing due to the use of an overly complex regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers, which can be exploited to cause excessive resource consumption...

CVE-2025-25200

A denial of service flaw was found in the koa library. An improperly designed regex is used to parse some specific HTTP headers. If untrusted requests are passed to koa, it can cause excessive resource usage on the server...

@oberd/olive-middleware-koa (>=1.2.7 <=1.3.2), @ysdn/admin (>=1.0.0 <=1.0.2) +149 more potentially affected by CVE-2025-25200 via koa (>=0.0.1 <=0.21.0)

koa NPM version =0.0.1, =1.2.7, =1.0.0, =0.0.0, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =0.2.0 - bonojs =0.1.0 and more Source cves: CVE-2025-25200 Source advisory: OSV:GHSA-593F-38F6-JP5M...

91jin (>=0.1.7 <=0.1.8), @aftonbladet/roc-package-web-app-gaea (>=0.1.0 <=0.4.1) +147 more potentially affected by CVE-2025-25200 via koa (>=1.0.0 <=1.7.0)

koa NPM version =1.0.0, =0.1.7, =0.1.0, =2.4.1, =0.0.2, =0.0.1, =0.1.0, =0.4.11, =0.1.0, =0.0.2, =1.2.1 and more Source cves: CVE-2025-25200 Source advisory: OSV:GHSA-593F-38F6-JP5M...

@24hr/content-next (>=1.0.0 <=3.0.17), @akemona-org/strapi (>=3.10.1 <=3.17.2) +775 more potentially affected by CVE-2025-25200 via koa (>=2.0.0 <=2.15.3)

koa NPM version =2.0.0, =1.0.0, =3.10.1, =3.7.0, =4.25.19-patch.1, =0.0.1, =0.3.1, =0.0.1, =0.0.50, =0.0.7, =1.0.1, =0.0.0, =0.4.2-alpha.0, =0.15.0 and more Source cves: CVE-2025-25200 Source advisory: OSV:GHSA-593F-38F6-JP5M...

GHSA-593F-38F6-JP5M Inefficient Regular Expression Complexity in koa

Summary Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. PoC Coming soon. Impact This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty...

Inefficient Regular Expression Complexity in koa

Summary Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. PoC Coming soon. Impact This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:koa is a Koa web app framework Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the parsing of X-Forwarded-Proto and X-Forwarded-Host HTTP headers. Details Denial of Service DoS describes a family of attacks, all aimed at...

CVE-2025-25200

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21....

CVE-2025-25200 Koa has Inefficient Regular Expression Complexity

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21....

CVE-2025-25200 Koa has Inefficient Regular Expression Complexity

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21....

CVE-2025-25200 Koa has Inefficient Regular Expression Complexity

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21....

CVE-2025-25200

CVE-2025-25200 — Koa (Node.js): A regex-based issue in Koa’s header parsing (X-Forwarded-Proto/Host) before versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 can be exploited to cause a Denial-of-Service. The fix is included in those versions (and later). The vulnerability stems from an inefficie...

Koa 安全漏洞

Koa is an open source middleware for Koa.js. A security vulnerability exists in Koa that stems from the use of malicious regular expressions to parse X-Forwarded-Proto and X-Forwarded-HostHTTP headers...

Same-Origin Policy Bypass

@koa/cors is vulnerable to Same-Origin Policy Bypass. The vulnerability exists in the index.js because the middleware operates in a way that if an allowed origin is not provided by default, it will return an Access-Control-Allow-Origin header with the value set to the origin from the request. Thi...

CVE-2023-49803

The CVE concerns the @koa/cors middleware for koa (Node.js). Before version 5.0.0, if an allowed origin is not provided, the middleware returns Access-Control-Allow-Origin with the request’s origin, effectively bypassing the browser’s Same-Origin Policy and exposing cross-origin data as described...

10.1zy (=1.0.0), 10.4ks (=1.0.0) +1643 more potentially affected by CVE-2023-49803 via @koa/cors (>=2.2.1 <=4.0.0)

@koa/cors NPM version =2.2.1, =0.1.2, =1.0.0, =0.1.28, =0.3.5, =1.1.11, =2.0.0, =3.0.0 and more Source cves: CVE-2023-49803 Source advisory: OSV:GHSA-QXRJ-HX23-XP82...

PT-2023-31361 · Npm · @Koa/Cors

Name of the Vulnerable Software and Affected Versions: @koa/cors versions prior to 5.0.0 Description: The @koa/cors middleware for the koa web framework in Node.js has a security issue where it returns an Access-Control-Allow-Origin header with the value of the origin from the request if an allow...

Malicious code in koa-colorful-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd44f0764b794e863572b93e1dd77d7927262ffcefb143a0ef4f38a205c7da27 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4207 Malicious code in koa-colorful-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd44f0764b794e863572b93e1dd77d7927262ffcefb143a0ef4f38a205c7da27 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...