Is koa 2.16 vulnerable?
npm · 5 releases from 2.16.0 to 2.16.4 · latest koa is 3.2.1 · checked 2 Nov 2026
No known advisories in the last release
koa 2.16.4, the last 2.16 release, has no known advisories. 4 advisories affect earlier 2.16.x releases, so update to 2.16.4.
npm install koa@2.16.4Fixed within 2.16.x, affecting earlier releases
Koa has Host Header Injection via ctx.hostname
- Affected
- >=3.0.0 <3.1.2 · <2.16.4
- Fixed in
- 2.16.4, 3.1.2
Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
- Affected
- >=3.0.1 <3.0.3 · >=2.16.2 <2.16.3
- Fixed in
- 2.16.3, 3.0.3
Koa Open Redirect via Referrer Header (User-Controlled)
- Affected
- >=2.0.0 <2.16.2 · >=3.0.0-alpha.0 <3.0.1
- Fixed in
- 2.16.2, 3.0.1
Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function
- Affected
- <2.16.1 · >=3.0.0-alpha.1 <3.0.0-alpha.5
- Fixed in
- 2.16.1, 3.0.0-alpha.5
Which of your client projects are still on koa 2.16?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact koa version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other koa versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.