~ / search / GHSA-593f-38f6-jp5m

GHSA-593f-38f6-jp5m

Inefficient Regular Expression Complexity in koa

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-25200

Packages

EcosystemPackageAffectedFixed in
npm koa >= 2.0.0, < 2.15.4 2.15.4
npm koa >= 3.0.0-alpha.0, < 3.0.0-alpha.3 3.0.0-alpha.3
npm koa >= 1.0.0, < 1.7.1 1.7.1
npm koa < 0.21.2 0.21.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. ### PoC Coming soon. ### Impact This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.

References

External links from the advisory. They lead to third-party sites.