CVE-2025-25200 Koa has Inefficient Regular Expression Complexity

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21....

Koa 安全漏洞

Koa is an open source middleware for Koa.js. A security vulnerability exists in Koa that stems from the use of malicious regular expressions to parse X-Forwarded-Proto and X-Forwarded-HostHTTP headers...

Same-Origin Policy Bypass

@koa/cors is vulnerable to Same-Origin Policy Bypass. The vulnerability exists in the index.js because the middleware operates in a way that if an allowed origin is not provided by default, it will return an Access-Control-Allow-Origin header with the value set to the origin from the request. Thi...

CVE-2023-49803

The CVE concerns the @koa/cors middleware for koa (Node.js). Before version 5.0.0, if an allowed origin is not provided, the middleware returns Access-Control-Allow-Origin with the request’s origin, effectively bypassing the browser’s Same-Origin Policy and exposing cross-origin data as described...

PT-2023-31361 · Npm · @Koa/Cors

Name of the Vulnerable Software and Affected Versions: @koa/cors versions prior to 5.0.0 Description: The @koa/cors middleware for the koa web framework in Node.js has a security issue where it returns an Access-Control-Allow-Origin header with the value of the origin from the request if an allow...

Malicious code in koa-colorful-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd44f0764b794e863572b93e1dd77d7927262ffcefb143a0ef4f38a205c7da27 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4207 Malicious code in koa-colorful-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd44f0764b794e863572b93e1dd77d7927262ffcefb143a0ef4f38a205c7da27 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shopify-koa-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 920990d18a9320864de3e853dadcce044cb66b0ddc0a8271c8c9485bd3921b06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6102 Malicious code in shopify-koa-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 920990d18a9320864de3e853dadcce044cb66b0ddc0a8271c8c9485bd3921b06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-R773-PMW3-F4MR Open Redirect in koa-remove-trailing-slashes

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

Open Redirect in koa-remove-trailing-slashes

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

Open Redirection

koa-remove-trailing-slashes is vulnerable to open redirection. The usage of relative URLs instead of absolute URLs in removeTrailingSlashes allows an attacker to use trailing double slashes in the URL to redirect users to malicious websites...

Cross-site scripting in @shopify/koa-shopify-auth

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

GHSA-JQH7-W5PR-CR56 Cross-site scripting in @shopify/koa-shopify-auth

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2021-23384

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

Open redirect

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

CVE-2021-23384

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

koa-remove-trailing-slashes 输入验证错误漏洞

koa-remove-trailing-slashes is an application. A Koa middleware that removes trailing slashes from paths. A security vulnerability exists in versions prior to koa-remove-trailing-slashes 2.0.2 that stems from vulnerability to Open Redirect...

GHSA-X45V-PVPG-HCRH Malicious Package in mysql-koa

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

Malicious Package in koa-body-parse

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...