CVE-2025-25200: Koa Package Suffers from Regex Denial-of-Service Vulnerability
Summary
CVE-2025-25200: Inefficient Regular Expression Complexity in koa. Affects koa across 4 version ranges.
< 0.21.2
>= 1.0.0, < 1.7.1
>= 2.0.0, < 2.15.4
>= 3.0.0-alpha.0, < 3.0.0-alpha.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Koa is a popular web framework for Node.js, designed to be lightweight and flexible. It allows developers to build web applications and APIs with a focus on middleware, making it easy to manage requests and responses. Koa's architecture promotes the use of async functions, which enhances performance and scalability. However, a recent vulnerability has been identified that affects its ability to handle certain HTTP headers securely.
Vulnerability Detail
The vulnerability arises from the use of an inefficient regular expression to parse the 'X-Forwarded-Proto' and 'X-Forwarded-Host' HTTP headers. This regex can be exploited to perform a Denial-of-Service (DoS) attack, leading to memory exhaustion. Attackers can send specially crafted requests that trigger excessive backtracking in the regex engine, causing the application to become unresponsive. This issue is classified under CWE-1333, highlighting the risks associated with poorly designed regex patterns.
How To Fix
Latest published version: 3.2.1 as of 22 Oct 2026
npm install koa@3.2.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.21.20.21.2npm install koa@0.21.2 -
>= 1.0.0, < 1.7.11.7.1npm install koa@1.7.1 -
>= 2.0.0, < 2.15.42.15.4npm install koa@2.15.4 -
>= 3.0.0-alpha.0, < 3.0.0-alpha.33.0.0-alpha.3npm install koa@3.0.0-alpha.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can validate and sanitize the 'X-Forwarded-Proto' and 'X-Forwarded-Host' headers before they are processed by Koa. This can be done by implementing middleware that checks for empty or malformed values and rejects requests that do not meet your criteria.
Conclusion
The Koa framework has a critical vulnerability related to regex parsing of HTTP headers, which can lead to Denial-of-Service attacks. It is crucial for developers using Koa to update to the latest patched versions to protect their applications. Implementing additional validation can serve as a temporary workaround while transitioning to secure versions.
See every vulnerability recorded for koa →
FAQ
The vulnerability is a Regex Denial-of-Service (ReDoS) attack that can exhaust memory resources, causing the application to crash or become unresponsive.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of Koa from 0.0.0 to 2.15.3, and 3.0.0-alpha.0 to 3.0.0-alpha.2 are affected by this vulnerability.
Yes, you can implement middleware to validate and sanitize the affected HTTP headers before they reach Koa.
If immediate upgrading is not possible, ensure to monitor your application closely for unusual traffic patterns and consider implementing the suggested middleware as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for koa.
