Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: koajs Component: Koa Clear all filters
TI-2026-22302 CVE-2026-27959 · GHSA-7gcc-r8m5-44qm

Koa has Host Header Injection via `ctx.hostname`

Priority HIGH 72

Koa is middleware for Node.js using ES2017 async functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00391 Published 2026-02-26 Partial fix · 3.1.2, 2.16.4 CWE-20
TI-2025-07436 CVE-2025-8129 · GHSA-jgmv-j7ww-jx2x

KoaJS Koa HTTP Header response.js back redirect

Priority MEDIUM 56

A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00285 Published 2025-07-25 Partial fix · 2.16.2, 3.0.1 CWE-601
TI-2025-23458 CVE-2025-32379 · GHSA-x2rg-q646-7m2v

XSS at ctx.redirect() function in Koajs

Priority LOW 35

Koa is expressive middleware for Node.js using ES2017 async functions.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00267 Published 2025-04-09 Partial fix · 3.0.0-alpha.5, 2.16.1 CWE-79
TI-2025-18869 CVE-2025-25200 · GHSA-593f-38f6-jp5m

Koa has Inefficient Regular Expression Complexity

Priority MEDIUM 41

Koa is expressive middleware for Node.js using ES2017 async functions.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00841 Published 2025-02-12 Fixed in 0.21.2, 1.7.1 +2 CWE-1333