Skip to content
fr Sign in
7.5 High

CVE-2026-27959 Koa is middleware for Node.js using ES2017 async functions

Description

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift AI 2.25 1776742141 earliest → < 1776742141 1776742141
Red Hat OpenShift Container Platform 4.19 1775577192 earliest → < 1775577192 1775577192
Red Hat Developer Hub Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Self-service automation portal 2 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
koa 3.0 3.0.0 → < 3.1.2 3.1.2
koa 2.16 earliest → < 2.16.4 2.16.4

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift AI 2.25

The 140 CVEs of Red Hat OpenShift AI 2.25 →
CVE-2026-86332 A flaw was found in odh-dashboard in Red Hat OpenShift AI 6.5 Medium CVE-2026-18620 A flaw was found in Data Science Pipelines 7.1 High CVE-2026-18618 A flaw was found in ml-metadata 7.5 High CVE-2026-18611 A flaw was found in the Data Science Pipelines Operator 7.5 High
Track this CVE