CVE-2026-27959: Koa Host Header Injection Vulnerability
Summary
CVE-2026-27959: Koa has Host Header Injection via ctx.hostname. Affects koa across 2 version ranges.
< 2.16.4
>= 3.0.0, < 3.1.2
Fixed in 2.16.4 or 3.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Koa is a popular Node.js web framework designed for building web applications and APIs. It provides a robust set of features for web and mobile applications, including middleware support, routing, and a simplified API. However, Koa's handling of the HTTP Host header has a vulnerability that can lead to serious security issues, particularly in applications that rely on the ctx.hostname API for generating URLs and routing decisions.
Vulnerability Detail
The vulnerability arises from Koa's naive parsing of the HTTP Host header in its ctx.hostname API. When a malformed Host header is received, such as one containing an '@' symbol, Koa incorrectly extracts the hostname, allowing an attacker to control the value returned by ctx.hostname. This can lead to various attacks, including password reset poisoning, email verification bypass, and OAuth callback manipulation, all of which can compromise user accounts and sensitive data.
How To Fix
Latest published version: 3.2.1 as of 22 Oct 2026
npm install koa@3.2.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.16.42.16.4npm install koa@2.16.4 -
>= 3.0.0, < 3.1.23.1.2npm install koa@3.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement additional validation for the Host header in your application. For example, you can manually check the value of ctx.get('Host') and ensure it conforms to valid hostname formats before using it in your application logic. Here’s a simple example:
const validHost = (host) => /^[a-zA-Z0-9.-]+$/.test(host);
app.use(async ctx => {
const host = ctx.get('Host');
if (!validHost(host)) {
ctx.throw(400, 'Invalid Host header');
}
// Proceed with your application logic
});
Conclusion
The Koa Host Header Injection vulnerability (CVE-2026-27959) poses significant risks to applications that utilize the ctx.hostname API without proper validation. It is crucial for developers to update to the latest patched versions of Koa and implement additional validation measures to safeguard their applications against potential attacks.
See every vulnerability recorded for koa →
FAQ
The vulnerability allows attackers to inject malicious Host headers, leading to potential account takeover and other security issues.
If your application uses Koa and relies on ctx.hostname for URL generation or routing, it may be vulnerable. You can check your application using Vulert's playground at Vulert Scanner.
Consequences include password reset poisoning, email verification bypass, and OAuth callback manipulation, which can lead to unauthorized access to user accounts.
Yes, you can implement custom validation for the Host header as a temporary workaround until you can update to a patched version.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for koa.
