Denial-of-Service Vulnerability in Koa by the Koa Development Team
CVE-2025-25200
9.2CRITICAL
What is CVE-2025-25200?
The Koa middleware, used in Node.js applications, suffers from a vulnerability that arises from improper parsing of X-Forwarded-Proto and X-Forwarded-Host HTTP headers. Malicious actors can exploit this flaw using a crafted request, leading to Denial-of-Service attacks that cripple server functionality. This issue affects all versions prior to 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3. The Koa Development Team has released patches in the aforementioned versions to mitigate this risk.
Affected Version(s)
koa < 0.21.2 < 0.21.2
koa >= 1.0.0, < 1.7.1 < 1.0.0, 1.7.1
koa >= 2.0.0-alpha.1, < 2.15.4 < 2.0.0-alpha.1, 2.15.4