koajs koa
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-27959 | >= 3.0.0, < 3.1.2 ; < 2.16.4 | Koa has Host Header Injection via `ctx.hostname` | HIGH 8.2 | 0.4 % | ||
| CVE-2025-62595 | >= 2.16.2, < 2.16.3 ; >= 3.0.1, < 3.0.3 | Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic | MEDIUM 6.1 | 0.3 % | ||
| CVE-2025-8129 | 3.0 | KoaJS Koa HTTP Header response.js back redirect | MEDIUM 5.1 | 0.3 % | ||
| CVE-2025-32379 | >= 3.0.0-alpha.0, < 3.0.0-alpha.5 ; < 2.16.1 | XSS at ctx.redirect() function in Koajs | MEDIUM 6.1 | 0.3 % | ||
| CVE-2025-25200 | < 0.21.2 ; >= 1.0.0, < 1.7.1 ; >= 2.0.0-alpha.1, < 2.15.4 ; … | Koa has Inefficient Regular Expression Complexity | CRITICAL 9.2 | 0.8 % |