koajs koa up to 0.21.1/1.7.0/2.15.3/3.0.0-alpha.2 ES2017 redos

Summaryinfo

A vulnerability identified as problematic has been detected in koajs koa up to 0.21.1/1.7.0/2.15.3/3.0.0-alpha.2. This issue affects some unknown processing of the component ES2017. Performing a manipulation results in redos. This vulnerability was named CVE-2025-25200. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in koajs koa up to 0.21.1/1.7.0/2.15.3/3.0.0-alpha.2. This affects some unknown functionality of the component ES2017. The manipulation with an unknown input leads to a redos vulnerability. CWE is classifying the issue as CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. This is going to have an impact on availability. The summary by CVE is:

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-25200 since 02/03/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1449.003 according to MITRE ATT&CK.

Upgrading to version 0.21.2, 1.7.1, 2.15.4 or 3.0.0-alpha.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5054af6e31ffd451a4151a1fe144cef6e5d0d83c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• koajs

Name

• koa

Version

• 0.21.0
• 0.21.1
• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7.0
• 2.15.0
• 2.15.1
• 2.15.2
• 2.15.3
• 3.0.0-alpha.0
• 3.0.0-alpha.1
• 3.0.0-alpha.2

License

• open-source

Website

• Product: https://github.com/koajs/koa/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion