CVE-2025-25200: Koa inefficient regular expression in header parsing

CVE-2025-25200 · Severity: medium · CVSS 4 · Published 2025-02-12

Koa is a popular Node.js middleware framework that processes HTTP requests. The framework contains an inefficient regular expression in its X-Forwarded-Proto and X-Forwarded-Host header parsing logic that can be exploited to consume excessive CPU and memory, causing the application to become unresponsive or crash. An attacker can send specially crafted HTTP headers over the network to trigger this denial-of-service condition without any authentication.

Technologies: Koajs Koa. Vendors: Koajs.

Quick answers

Is CVE-2025-25200 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-25200 being exploited in the wild.
How severe is CVE-2025-25200?
Medium severity, with a CVSS score of 4, published 12 February 2025.
Which products and versions are affected?
Koajs Koa 0.x < 0.21.2.
Is there a fix for CVE-2025-25200?
A patch was published on 2025-02-12: Patched versions released: 0.21.2, 1.7.1, 2.15.4, 3.0.0-alpha.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-25200 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-25200?
Check whether you run Koajs Koa at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Regular Expression Denial-of-Service (ReDoS) attack exploiting CWE-1333 (inefficient regular expression complexity). Koa uses an "evil regex" with exponential worst-case computational complexity to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. The vulnerable component is the host and protocol getter logic, activated when the app.proxy setting is enabled. An unauthenticated attacker can send malicious HTTP requests over the network with specially crafted header values that trigger catastrophic backtracking in the regex engine, causing memory exhaustion and CPU exhaustion. This results in denial of service against the affected Koa application. Patches have been released in versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 that improve the regex and disallow empty header values.

Affected products

  • koajs koa 0.x < 0.21.2
  • koajs koa 1.0.0 to < 1.7.1
  • koajs koa 2.0.0 to < 2.15.4
  • koajs koa 3.0.0-alpha.0 to < 3.0.0-alpha.3

Identifiers

  • CVE-2025-25200
  • GHSA-593f-38f6-jp5m

Timeline

  • 2025-02-12: disclosed
  • 2025-02-12: patched: Patched versions released: 0.21.2, 1.7.1, 2.15.4, 3.0.0-alpha.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.