CVE-2026-27959
Description
Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.
How to fix
- koajs koa2.16.4, 3.1.2 or later
- koa3.1.2, 2.16.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| koajs koa | v < 2.16.4, 3.0.0 ≤ v < 3.1.2 | 2.16.4, 3.1.2 |
| koanpm | 3.0.0 ≤ v < 3.1.2, v < 2.16.4 | 3.1.2, 2.16.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.