CVSS 4.0
9.2 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:HCVE-2025-25200
Critical (9.2) in koajs koa. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in koa 0.21.2, 1.7.1, 2.15.4.
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1333
- Published
- Modified
- Record from
- the NVD, synced
Affected
- koajs:koa
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-593f-38f6-jp5m | npm | koa | >=2.0.0 <2.15.4 | 2.15.4 |
| GHSA-593f-38f6-jp5m | npm | koa | >=3.0.0-alpha.0 <3.0.0-alpha.3 | 3.0.0-alpha.3 |
| GHSA-593f-38f6-jp5m | npm | koa | >=1.0.0 <1.7.1 | 1.7.1 |
| GHSA-593f-38f6-jp5m | npm | koa | <0.21.2 | 0.21.2 |
References
- https://github.com/koajs/koa/blob/master/lib/request.js#L259
- https://github.com/koajs/koa/blob/master/lib/request.js#L404
- https://github.com/koajs/koa/commit/5054af6e31ffd451a4151a1fe144cef6e5d0d83c
- https://github.com/koajs/koa/commit/5f294bb1c7c8d9c61904378d250439a321bffd32
- https://github.com/koajs/koa/commit/93fe903fc966635a991bcf890cfc3427d33a1a08