Skip to content
KKoaJS
Products
| Product | CVEs | Exploited | Latest |
|---|
| Koa | 5 | – | Feb 26, 2026 |
| cors | 1 | – | Dec 11, 2023 |
Exploited and recent CVEs
-
CVE-2026-27959
High 7.5
Koa has Host Header Injection via `ctx.hostname`
0.4%
-
CVE-2025-62595
Medium 4.3
Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
0.3%
-
CVE-2025-8129
Low 3.5
KoaJS Koa HTTP Header response.js back redirect
0.3%
-
CVE-2025-32379
Medium 5.0
XSS at ctx.redirect() function in Koajs
0.3%
-
CVE-2025-25200
Critical 9.2
Koa has Inefficient Regular Expression Complexity
0.8%
-
CVE-2023-49803
High 8.6
@koa/cors has overly permissive origin policy
0.3%