CVE-2025-25200

Name of the Vulnerable Software and Affected Versions: Koa versions prior to 0.21.2 Koa versions prior to 1.7.1 Koa versions prior to 2.15.4 Koa versions prior to 3.0.0-alpha.3

Description: The issue concerns a Denial-of-Service attack due to Koa using an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack, causing memory exhaustion.

Recommendations: For versions prior to 0.21.2, update to version 0.21.2 or later. For versions prior to 1.7.1, update to version 1.7.1 or later. For versions prior to 2.15.4, update to version 2.15.4 or later. For versions prior to 3.0.0-alpha.3, update to version 3.0.0-alpha.3 or later. As a temporary workaround, consider restricting access to the X-Forwarded-Proto and X-Forwarded-Host HTTP headers until a patch is available.