PatchTheCVE: koa

CVE-2026-27959: Koa is middleware for Node.js using ES2017 async functions

Wed, 15 Jul 2026 02:19:12 +0000

HIGH 7.5: Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Ho

CVE-2025-62595: Koa is expressive middleware for Node.js using ES2017 async functions

Thu, 08 Oct 2026 11:10:00 +0000

MEDIUM 4.3: Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the R

CVE-2025-8129: A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0

Wed, 17 Jun 2026 10:06:21 +0000

LOW 3.5: A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely.

CVE-2025-32379: Koa is expressive middleware for Node.js using ES2017 async functions

Wed, 17 Jun 2026 09:11:54 +0000

MEDIUM 5.0: Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.

CVE-2025-25200: Koa is expressive middleware for Node.js using ES2017 async functions

Wed, 17 Jun 2026 09:00:28 +0000

HIGH 7.5: Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21