CVE-2025-25200: Koajs Koa

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.

Affected products

• Koajs Koa: before 0.21.2 (fixed in 0.21.2); from 1.0.0, before 1.7.1 (fixed in 1.7.1); from 2.0.0, before 2.15.4 (fixed in 2.15.4); version 3.0.0 only

Published 2025-02-12. Last modified 2026-06-17.