Read the docs
TI-2026-22302 Aliases CVE-2026-27959GHSA-7gcc-r8m5-44qm

Koa has Host Header Injection via `ctx.hostname`

Priority HIGH 72CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00391 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial koa (koajs): 3.1.2, 2.16.4koa (npm): 3.1.2, 2.16.4Red Hat: 2 advisoriesRed Hat: 2 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
koajskoa3.0.0 to before 3.1.2; before 2.16.43.1.2, 2.16.4Patch availableCNA
—koa (npm)3.0.0 to before 3.1.23.1.2Patch availableGHSA-7gcc-r8m5-44qm
—koa (npm)before 2.16.42.16.4Patch availableGHSA-7gcc-r8m5-44qm
  • koa Vendorkoajs Affected 3.0.0 to before 3.1.2; before 2.16.4 Fixed in 3.1.2, 2.16.4 Patch available CNA
  • koa (npm) Vendor— Affected 3.0.0 to before 3.1.2 Fixed in 3.1.2 Patch available GHSA-7gcc-r8m5-44qm
  • koa (npm) Vendor— Affected before 2.16.4 Fixed in 2.16.4 Patch available GHSA-7gcc-r8m5-44qm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:*before 2.16.4; 3.0.0 to before 3.1.2Vulnerablekoajs
  • cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* Versions before 2.16.4; 3.0.0 to before 3.1.2 Vulnerable ·koajs

Remediation

  • Fix · CNA koa (koajs) Fixed in 3.1.2, 2.16.4
  • Fix · GHSA-7gcc-r8m5-44qm koa (npm) Fixed in 3.1.2 Advisory →
  • Fix · GHSA-7gcc-r8m5-44qm koa (npm) Fixed in 2.16.4 Advisory →

Red Hat 2 advisories

  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:7249 Released 2026-04-16 · Red Hat rating Important
    OpenShift Container Platform 4.19.28 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix planned: Out of support scope
Self-service automation portal 2AffectedNo fix yet
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:7249
Not affected: 3 products
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27959
  2. 2026-10-03 Alias added: GHSA-7gcc-r8m5-44qm
  3. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 1

  • TI-2025-38810 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic CVSS 3.1MEDIUM 6.1
  • TI-2025-07436 KoaJS Koa HTTP Header response.js back redirect CVSS 4.0MEDIUM 5.1
  • TI-2025-18869 Koa has Inefficient Regular Expression Complexity CVSS 4.0CRITICAL 9.2
  • TI-2025-23458 XSS at ctx.redirect() function in Koajs CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences