CVE-2025-25200: Koa has Inefficient Regular Expression Complexity
Summary Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.
PoC
Coming soon.
Impact This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.
Other sources
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/koato a version that resolves this vulnerability.Fixed in 0.21.2 - Upgrade
Upgrade
npm/koato a version that resolves this vulnerability.Fixed in 1.7.1 - Upgrade
Upgrade
npm/koato a version that resolves this vulnerability.Fixed in 3.0.0-alpha.3 - Upgrade
Upgrade
npm/koato a version that resolves this vulnerability.Fixed in 2.15.4 - Upgrade
Upgrade
Koato a version that resolves this vulnerability.Fixed in 0.21.2 - Upgrade
Upgrade
Koato a version that resolves this vulnerability.Fixed in 1.7.1 - Upgrade
Upgrade
Koato a version that resolves this vulnerability.Fixed in 2.15.4 - Upgrade
Upgrade
Koato a version that resolves this vulnerability.Fixed in 3.0.0-alpha.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25200?
CVE-2025-25200 has a moderate severity level due to its potential to cause Denial-of-Service attacks.
How do I fix CVE-2025-25200?
To fix CVE-2025-25200, upgrade Koa to versions 0.21.2, 1.7.1, 2.15.4, or 3.0.0-alpha.3 or later.
Which versions of Koa are affected by CVE-2025-25200?
CVE-2025-25200 affects Koa versions prior to 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3.
What is the nature of the vulnerability in CVE-2025-25200?
CVE-2025-25200 involves a regex flaw that can be exploited through unsafe parsing of HTTP headers.
Can CVE-2025-25200 affect my Node.js application?
Yes, if your application uses an affected version of Koa, it may be vulnerable to Denial-of-Service attacks.