Is koa 3.0 vulnerable?
npm · 4 releases from 3.0.0 to 3.0.3 · latest koa is 3.2.1 · checked 2 Nov 2026
Yes: 1 known advisory
Yes. koa 3.0.3, the last 3.0 release, is affected by 1 known security advisory (1 high), including CVE-2026-27959. 2 more affect earlier 3.0.x releases. Upgrade to 3.1.2 or later to fix all of them.
npm install koa@3.1.2Advisories affecting koa 3.0.3
Koa has Host Header Injection via ctx.hostname
- Affected
- >=3.0.0 <3.1.2 · <2.16.4
- Fixed in
- 2.16.4, 3.1.2
Fixed within 3.0.x, affecting earlier releases
Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
- Affected
- >=3.0.1 <3.0.3 · >=2.16.2 <2.16.3
- Fixed in
- 2.16.3, 3.0.3
Koa Open Redirect via Referrer Header (User-Controlled)
- Affected
- >=2.0.0 <2.16.2 · >=3.0.0-alpha.0 <3.0.1
- Fixed in
- 2.16.2, 3.0.1
Which of your client projects are still on koa 3.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact koa version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other koa versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.