| Package | Affected versions | Patched versions |
|---|---|---|
| koa | = 3.0.0≥ 1.0.0, < 1.7.1≥ 2.0.0, < 2.15.4< 0.21.2 | 1.7.12.15.40.21.2 |
| koa | ≥ 1.0.0, < 1.7.1≥ 2.0.0, < 2.15.4≥ 3.0.0-alpha.0, < 3.0.0-alpha.3< 0.21.2 | 1.7.12.15.43.0.0-alpha.30.21.2 |
Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.
Coming soon.
This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free