Executive brief
Koa, a popular web framework for Node.js, contains a flaw in how it identifies the server's own name from incoming web requests. An attacker can send a specially crafted web request that tricks the application into using a malicious domain name when generating links. This can lead to serious security issues like 'password reset poisoning,' where a legitimate user is sent an email containing a link that secretly directs them to an attacker's site to steal their login credentials.
Technical details
Koa's `ctx.hostname` API naively parses the HTTP Host header (or `:authority` in HTTP/2) by extracting all characters before the first colon without validating the result against RFC 3986 hostname syntax. By providing a malformed header containing an '@' symbol (e.g., `evil.com:fake@legitimate.com`), an attacker can manipulate `ctx.hostname` to return an arbitrary domain like `evil.com`. This occurs because the parser fails to recognize that the '@' character designates user information rather than a port delimiter. This vulnerability enables Host header injection, which can be leveraged for password reset poisoning, web cache poisoning, and OAuth redirect manipulation. The issue is fixed in versions 2.16.4 and 3.1.2 by using a proper URL parser to extract the host portion.
Affected products
- koajs Koa < 2.16.4, >= 3.0.0 < 3.1.2
Timeline
- 2026-02-25: advisory: GitHub Security Advisory GHSA-7gcc-r8m5-44qm published
- 2026-02-26: disclosed: CVE-2026-27959 published to NVD