Junglewise Threat Intelligence

CVE-2025-25200: Koa inefficient regular expression in header parsing

CVE-2025-25200 · Severity: medium · CVSS 4 · Published 2025-02-12

Technologies: Koajs Koa. Vendors: Koajs.

Executive brief

Koa is a popular Node.js middleware framework that processes HTTP requests. The framework contains an inefficient regular expression in its X-Forwarded-Proto and X-Forwarded-Host header parsing logic that can be exploited to consume excessive CPU and memory, causing the application to become unresponsive or crash. An attacker can send specially crafted HTTP headers over the network to trigger this denial-of-service condition without any authentication.

Technical details

The vulnerability is a Regular Expression Denial-of-Service (ReDoS) attack exploiting CWE-1333 (inefficient regular expression complexity). Koa uses an "evil regex" with exponential worst-case computational complexity to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. The vulnerable component is the host and protocol getter logic, activated when the app.proxy setting is enabled. An unauthenticated attacker can send malicious HTTP requests over the network with specially crafted header values that trigger catastrophic backtracking in the regex engine, causing memory exhaustion and CPU exhaustion. This results in denial of service against the affected Koa application. Patches have been released in versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 that improve the regex and disallow empty header values.

Affected products

  • koajs koa 0.x < 0.21.2
  • koajs koa 1.0.0 to < 1.7.1
  • koajs koa 2.0.0 to < 2.15.4
  • koajs koa 3.0.0-alpha.0 to < 3.0.0-alpha.3

Timeline

  • 2025-02-12: disclosed
  • 2025-02-12: patched: Patched versions released: 0.21.2, 1.7.1, 2.15.4, 3.0.0-alpha.3

References

Related threats