← Vulnerability feed

Vulnerability record · CVE-2025-25200 · published 12 February 2025

CVE-2025-25200: Koajs koa inefficient regular expression (redos) vulnerability

KKoajs · Koa

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.

9.2 CVSS 4.0 Critical EPSS 0.84% · top 43.8% CWE-1333 · Inefficient regular expression (ReDoS)
9.2CVSS 4.0 base score
0.84%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References
17 Jun 2026Last modified by NVD

Description

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/koajs/koa/blob/master/lib/request.js#L259 Product
https://github.com/koajs/koa/blob/master/lib/request.js#L404 Product
https://github.com/koajs/koa/commit/5054af6e31ffd451a4151a1fe144cef6e5d0d83c Patch
https://github.com/koajs/koa/commit/5f294bb1c7c8d9c61904378d250439a321bffd32 Patch
https://github.com/koajs/koa/commit/93fe903fc966635a991bcf890cfc3427d33a1a08 Patch
https://github.com/koajs/koa/releases/tag/2.15.4 Release Notes
https://github.com/koajs/koa/security/advisories/GHSA-593f-38f6-jp5m Vendor Advisory

Track CVE-2025-25200 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-27959Koajs koa improper input validation vulnerabilityKoa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of th…EPSS 0.52%6.1CVE-2025-62595Koajs koa open redirect vulnerabilityKoa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE…EPSS 0.30%6.1CVE-2025-32379Koajs koa cross-site scripting vulnerabilityKoa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redir…EPSS 0.26%2.0CVE-2025-8129Koajs koa open redirect vulnerabilityA vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.j…EPSS 0.24%

Source: NIST National Vulnerability Database (record CVE-2025-25200), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.