@koa/cors has overly permissive origin policy

CVE-2023-49803

What is CVE-2023-49803?

@koa/cors, a middleware package for the Koa web framework, was found to have a significant security flaw where it improperly handles requests without specified allowed origins. In versions prior to 5.0.0, the middleware would return an 'Access-Control-Allow-Origin' header based on the request origin, undermining the Same Origin Policy (SOP). This can lead to severe security issues by allowing potentially malicious domains to access and manipulate the resources of an application. Users must be aware of this behavior and exercise caution, especially when using this middleware in production environments. It is recommended to upgrade to version 5.0.0 or later to mitigate this risk.

References