CriticalGHSA-593f-38f6-jp5mCVE-2025-25200

Inefficient Regular Expression Complexity in koa

Published 12 Feb 2025 · Updated 12 Feb 2025

Affected packages

koanpm
Affected
>=2.0.0 <2.15.4
Fixed in
2.15.4
Update to the fixed version for your release line, for example:npm install koa@2.15.4
koanpm
Affected
>=3.0.0-alpha.0 <3.0.0-alpha.3
Fixed in
3.0.0-alpha.3
Update to the fixed version for your release line, for example:npm install koa@3.0.0-alpha.3
koanpm
Affected
>=1.0.0 <1.7.1
Fixed in
1.7.1
Update to the fixed version for your release line, for example:npm install koa@1.7.1
koanpm
Affected
<0.21.2
Fixed in
0.21.2
Update to the fixed version for your release line, for example:npm install koa@0.21.2

Details

Summary

Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.

PoC

Coming soon.

Impact

This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.

Is GHSA-593f-38f6-jp5m in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected koa, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.