CVE-2025-25200
CVE-2025-25200 · Koa has Inefficient Regular Expression Complexity
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
CVSS 9.2 · Critical · EPSS 0.8% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
koa
- Versions
- < 0.21.2: Affected
- >= 1.0.0, < 1.7.1: Affected
- >= 2.0.0-alpha.1, < 2.15.4: Affected
- >= 3.0.0-alpha.0, < < 3.0.0-alpha.3: Affected
No fix published
koa npm
- Affected ranges
- SEMVER: ≥ 2.0.0, < 2.15.4
Update to 2.15.4
koa npm
- Affected ranges
- SEMVER: ≥ 3.0.0-alpha.0, < 3.0.0-alpha.3
Update to 3.0.0-alpha.3
koa npm
- Affected ranges
- SEMVER: ≥ 1.0.0, < 1.7.1
Update to 1.7.1
koa npm
- Affected ranges
- SEMVER: < 0.21.2
Update to 0.21.2
Original sources
- https://github.com/koajs/koa/security/advisories/GHSA-593f-38f6-jp5m
- https://github.com/koajs/koa/commit/5054af6e31ffd451a4151a1fe144cef6e5d0d83c
- https://github.com/koajs/koa/commit/5f294bb1c7c8d9c61904378d250439a321bffd32
- https://github.com/koajs/koa/commit/93fe903fc966635a991bcf890cfc3427d33a1a08
- https://github.com/koajs/koa/blob/master/lib/request.js#L259
- https://github.com/koajs/koa/blob/master/lib/request.js#L404
- https://github.com/koajs/koa/releases/tag/2.15.4
- https://nvd.nist.gov/vuln/detail/CVE-2025-25200