Vulnerability · Published Feb 12, 2025 · Assigned by GitHub_M
CVE-2025-25200Koa has Inefficient Regular Expression Complexity
Critical 9.2
In plain English
A critical-severity regular-expression denial of service in koa from koajs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | koa | 2.15.4 | GHSA-593f-38f6-jp5m |
| npm | koa | 3.0.0-alpha.3 | GHSA-593f-38f6-jp5m |
| npm | koa | 1.7.1 | GHSA-593f-38f6-jp5m |
| npm | koa | 0.21.2 | GHSA-593f-38f6-jp5m |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
References
- https://github.com/koajs/koa/security/advisories/GHSA-593f-38f6-jp5m x_refsource_CONFIRM
- https://github.com/koajs/koa/commit/5054af6e31ffd451a4151a1fe144cef6e5d0d83c x_refsource_MISC
- https://github.com/koajs/koa/commit/5f294bb1c7c8d9c61904378d250439a321bffd32 x_refsource_MISC
- https://github.com/koajs/koa/commit/93fe903fc966635a991bcf890cfc3427d33a1a08 x_refsource_MISC
- https://github.com/koajs/koa/blob/master/lib/request.js#L259 x_refsource_MISC
- https://github.com/koajs/koa/blob/master/lib/request.js#L404 x_refsource_MISC
- https://github.com/koajs/koa/releases/tag/2.15.4 x_refsource_MISC