En bref
- CVE-2025-25200 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant koa (koajs), koa.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.84%, plus élevée que 58.0% des vulnérabilités.
- Correctif : mettre à jour vers 1.7.1, 2.15.4, 0.21.2, 3.0.0-alpha.3 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| koa | = 3.0.0≥ 1.0.0, < 1.7.1≥ 2.0.0, < 2.15.4< 0.21.2
| 1.7.12.15.40.21.2
|
| koa npm | ≥ 1.0.0, < 1.7.1≥ 2.0.0, < 2.15.4≥ 3.0.0-alpha.0, < 3.0.0-alpha.3< 0.21.2
| 1.7.12.15.43.0.0-alpha.30.21.2
|
Description
Summary
Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.
PoC
Coming soon.
Impact
This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.
NVD description
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free