Skip to content
fr Sign in
9.2 Critical

CVE-2025-25200 Koa is expressive middleware for Node.js using ES2017 async functions

Description

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.

Affected products and versions

Product Affected versions Fixed in
koa 2.0 2.0.0-alpha.1 → < 2.15.4 2.15.4
koa 1.0 1.0.0 → < 1.7.1 1.7.1
koa 0.21 earliest → < 0.21.2 0.21.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of koa

The 5 CVEs of koa →
CVE-2026-27959 Koa is middleware for Node.js using ES2017 async functions 7.5 High CVE-2025-62595 Koa is expressive middleware for Node.js using ES2017 async functions 4.3 Medium CVE-2025-8129 A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0 5.1 Medium CVE-2025-32379 Koa is expressive middleware for Node.js using ES2017 async functions 5.0 Medium
Track this CVE