CVE-2025-25200: Koa has Inefficient Regular Expression Complexity
### Summary Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. ### PoC Coming soon. ### Impact This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25200?
CVE-2025-25200 has a moderate severity level due to its potential to cause Denial-of-Service attacks.
How do I fix CVE-2025-25200?
To fix CVE-2025-25200, upgrade Koa to versions 0.21.2, 1.7.1, 2.15.4, or 3.0.0-alpha.3 or later.
Which versions of Koa are affected by CVE-2025-25200?
CVE-2025-25200 affects Koa versions prior to 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3.
What is the nature of the vulnerability in CVE-2025-25200?
CVE-2025-25200 involves a regex flaw that can be exploited through unsafe parsing of HTTP headers.
Can CVE-2025-25200 affect my Node.js application?
Yes, if your application uses an affected version of Koa, it may be vulnerable to Denial-of-Service attacks.