Is koa safe ? 5 known vulnerabilities, worst severity CRITICAL.
// reach 36 direct dependencies
4 carry known advisories, worst HIGH
68 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss CVSS v4.0 base score out of 10
epss chance of exploitation in 30 days, 58th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-593f-38f6-jp5m, the advisory selected below
// 5 advisories GHSA-593f-38f6-jp5m Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. CRIT GHSA-7gcc-r8m5-44qm Koa's ctx.hostname API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a @ symbol (e.g., evil.com:fake@legitimate.com) is received, ctx.hostname returns evil.com - an attacker-controlled value. Applications using ctx.hostname for URL generation, pa HIGH GHSA-g8mr-fgfg-5qpc A bypass was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow MODE GHSA-x2rg-q646-7m2v In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. MODE GHSA-jgmv-j7ww-jx2x In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target. LOW // summary Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.
// poc Coming soon.
// impact This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.
// cvss v4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Attack vector Network
Attack complexity Low
Attack requirements None
Privileges required None
User interaction None
Confidentiality (vulnerable system) None
Integrity (vulnerable system) None
Availability (vulnerable system) High
Confidentiality (subsequent systems) None
Integrity (subsequent systems) None
Availability (subsequent systems) High Checked 2026-11-06 at 21:00 UTC. The most recent advisory here was published 2026-02-26. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page