Koa vulnerabilities

2 known vulnerabilities in Koa from KoaJS. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Koa is middleware for Node.js using ES2017 async functions.

  CVE-2026-27959Feb 26, 2026KoaJS

  Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3

• 7.5 High severity

  koa: Inefficient Regular Expression Complexity

  CVE-2025-25200Feb 12, 2025KoaJS

  Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a