Is CVE-2026-27959 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27959 being exploited in the wild.

How severe is CVE-2026-27959?

High severity, with a CVSS score of 7.5, published 26 February 2026.

Which products and versions are affected?

koa (npm) SEMVER:introduced=3.0.0,fixed=3.1.2.

Is there a fix for CVE-2026-27959?

Yes. koa (npm): upgrade to 3.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27959 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27959?

Check whether you run koa (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27959: Koa Host header injection in ctx.hostname API

CVE-2026-27959 · Severity: high · CVSS 7.5 · Published 2026-02-26

Koa, a popular web framework for Node.js, contains a flaw in how it identifies the server's own name from incoming web requests. An attacker can send a specially crafted web request that tricks the application into using a malicious domain name when generating links. This can lead to serious security issues like 'password reset poisoning,' where a legitimate user is sent an email containing a link that secretly directs them to an attacker's site to steal their login credentials.

Technologies: koa (npm). Vendors: npm.

Quick answers

Is CVE-2026-27959 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27959 being exploited in the wild.
How severe is CVE-2026-27959?: High severity, with a CVSS score of 7.5, published 26 February 2026.
Which products and versions are affected?: koa (npm) SEMVER:introduced=3.0.0,fixed=3.1.2.
Is there a fix for CVE-2026-27959?: Yes. koa (npm): upgrade to 3.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27959 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27959?: Check whether you run koa (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

koa (npm): upgrade to 3.1.2 or later
```
npm install koa@3.1.2
```

Technical details

Koa's `ctx.hostname` API naively parses the HTTP Host header (or `:authority` in HTTP/2) by extracting all characters before the first colon without validating the result against RFC 3986 hostname syntax. By providing a malformed header containing an '@' symbol (e.g., `evil.com:fake@legitimate.com`), an attacker can manipulate `ctx.hostname` to return an arbitrary domain like `evil.com`. This occurs because the parser fails to recognize that the '@' character designates user information rather than a port delimiter. This vulnerability enables Host header injection, which can be leveraged for password reset poisoning, web cache poisoning, and OAuth redirect manipulation. The issue is fixed in versions 2.16.4 and 3.1.2 by using a proper URL parser to extract the host portion.

Affected products

koajs Koa < 2.16.4, >= 3.0.0 < 3.1.2

Identifiers

CVE-2026-27959
GHSA-7gcc-r8m5-44qm

Timeline

2026-02-25: advisory: GitHub Security Advisory GHSA-7gcc-r8m5-44qm published
2026-02-26: disclosed: CVE-2026-27959 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.