TI-2026-22302 CVE-2026-27959 · GHSA-7gcc-r8m5-44qm
Koa has Host Header Injection via `ctx.hostname`
Priority HIGH 72
Koa is middleware for Node.js using ES2017 async functions.
koajs
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
koajs records in CISA KEVNo koajs vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records in Koa · all components
TI-2025-38810 CVE-2025-62595 · GHSA-g8mr-fgfg-5qpc
Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
Priority MEDIUM 60
Koa is expressive middleware for Node.js using ES2017 async functions.
TI-2025-07436 CVE-2025-8129 · GHSA-jgmv-j7ww-jx2x
KoaJS Koa HTTP Header response.js back redirect
Priority MEDIUM 56
A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0.
TI-2025-18869 CVE-2025-25200 · GHSA-593f-38f6-jp5m
Koa has Inefficient Regular Expression Complexity
Priority MEDIUM 41
Koa is expressive middleware for Node.js using ES2017 async functions.
TI-2025-23458 CVE-2025-32379 · GHSA-x2rg-q646-7m2v
XSS at ctx.redirect() function in Koajs
Priority LOW 35
Koa is expressive middleware for Node.js using ES2017 async functions.