Read the docs
TI-2025-18869 Aliases CVE-2025-25200GHSA-593f-38f6-jp5m

Koa has Inefficient Regular Expression Complexity

Priority MEDIUM 41CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00841 58th percentileScored 2026-11-07
Fix Fixed koa (koajs): 0.21.2, 1.7.1, 2.15.4koa (npm): 2.15.4, 3.0.0-alpha.3, 1.7.1 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
koajskoabefore 0.21.2; 1.0.0 to before 1.7.1; 2.0.0-alpha.1 to before 2.15.4; >= 3.0.0-alpha.0, < < 3.0.0-alpha.30.21.2, 1.7.1, 2.15.4Patch availableCNA
—koa (npm)2.0.0 to before 2.15.42.15.4Patch availableGHSA-593f-38f6-jp5m
—koa (npm)3.0.0-alpha.0 to before 3.0.0-alpha.33.0.0-alpha.3Patch availableGHSA-593f-38f6-jp5m
—koa (npm)1.0.0 to before 1.7.11.7.1Patch availableGHSA-593f-38f6-jp5m
—koa (npm)before 0.21.20.21.2Patch availableGHSA-593f-38f6-jp5m
  • koa Vendorkoajs Affected before 0.21.2; 1.0.0 to before 1.7.1; 2.0.0-alpha.1 to before 2.15.4; >= 3.0.0-alpha.0, < < 3.0.0-alpha.3 Fixed in 0.21.2, 1.7.1, 2.15.4 Patch available CNA
  • koa (npm) Vendor— Affected 2.0.0 to before 2.15.4 Fixed in 2.15.4 Patch available GHSA-593f-38f6-jp5m
  • koa (npm) Vendor— Affected 3.0.0-alpha.0 to before 3.0.0-alpha.3 Fixed in 3.0.0-alpha.3 Patch available GHSA-593f-38f6-jp5m
  • koa (npm) Vendor— Affected 1.0.0 to before 1.7.1 Fixed in 1.7.1 Patch available GHSA-593f-38f6-jp5m
  • koa (npm) Vendor— Affected before 0.21.2 Fixed in 0.21.2 Patch available GHSA-593f-38f6-jp5m

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:*before 0.21.2; 1.0.0 to before 1.7.1; 2.0.0 to before 2.15.4Vulnerablekoajs
cpe:2.3:a:koajs:koa:3.0.0:alpha0:*:*:*:node.js:*:*3.0.0 alpha0Vulnerablekoajs
cpe:2.3:a:koajs:koa:3.0.0:alpha1:*:*:*:node.js:*:*3.0.0 alpha1Vulnerablekoajs
cpe:2.3:a:koajs:koa:3.0.0:alpha2:*:*:*:node.js:*:*3.0.0 alpha2Vulnerablekoajs
  • cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* Versions before 0.21.2; 1.0.0 to before 1.7.1; 2.0.0 to before 2.15.4 Vulnerable ·koajs
  • cpe:2.3:a:koajs:koa:3.0.0:alpha0:*:*:*:node.js:*:* Versions 3.0.0 alpha0 Vulnerable ·koajs
  • cpe:2.3:a:koajs:koa:3.0.0:alpha1:*:*:*:node.js:*:* Versions 3.0.0 alpha1 Vulnerable ·koajs
  • cpe:2.3:a:koajs:koa:3.0.0:alpha2:*:*:*:node.js:*:* Versions 3.0.0 alpha2 Vulnerable ·koajs

Remediation

  • Fix · CNA koa (koajs) Fixed in 0.21.2, 1.7.1, 2.15.4
  • Fix · GHSA-593f-38f6-jp5m koa (npm) Fixed in 2.15.4 Advisory →
  • Fix · GHSA-593f-38f6-jp5m koa (npm) Fixed in 3.0.0-alpha.3 Advisory →
  • Fix · GHSA-593f-38f6-jp5m koa (npm) Fixed in 1.7.1 Advisory →
  • Fix · GHSA-593f-38f6-jp5m koa (npm) Fixed in 0.21.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-25200
  2. 2026-10-03 Alias added: GHSA-593f-38f6-jp5m

References

Patch 3

Advisory 2

Other 4

  • TI-2026-22302 Koa has Host Header Injection via `ctx.hostname` CVSS 3.1HIGH 7.5
  • TI-2025-38810 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic CVSS 3.1MEDIUM 6.1
  • TI-2025-07436 KoaJS Koa HTTP Header response.js back redirect CVSS 4.0MEDIUM 5.1
  • TI-2025-23458 XSS at ctx.redirect() function in Koajs CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences