CVE-2026-27959: CWE-20: Improper Input Validation in koajs koa
Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.
AI Analysis
Technical Summary
Koa middleware for Node.js versions before 2.16.4 and 3.1.2 have an improper input validation vulnerability (CWE-20) in the ctx.hostname API. The API naively parses the HTTP Host header by extracting everything before the first colon without ensuring the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing an '@' symbol is processed, ctx.hostname returns an attacker-controlled value, enabling host header injection. This can affect applications that use ctx.hostname for URL generation, password reset links, email verification URLs, or routing decisions. The vulnerability is addressed in Koa versions 2.16.4 and 3.1.2.
Potential Impact
The vulnerability allows attackers to control the value returned by ctx.hostname by sending a malformed Host header with an '@' symbol. This can lead to host header injection attacks, potentially impacting URL generation, password reset links, email verification URLs, and routing decisions in affected applications. The CVSS score is 7.5 (high severity), indicating a significant risk if exploited. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available in Koa versions 2.16.4 and 3.1.2. Users should upgrade to at least these versions to remediate the vulnerability. No additional vendor advisory indicates alternative mitigations or that no action is required.
CVE-2026-27959: CWE-20: Improper Input Validation in koajs koa
Description
Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Koa middleware for Node.js versions before 2.16.4 and 3.1.2 have an improper input validation vulnerability (CWE-20) in the ctx.hostname API. The API naively parses the HTTP Host header by extracting everything before the first colon without ensuring the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing an '@' symbol is processed, ctx.hostname returns an attacker-controlled value, enabling host header injection. This can affect applications that use ctx.hostname for URL generation, password reset links, email verification URLs, or routing decisions. The vulnerability is addressed in Koa versions 2.16.4 and 3.1.2.
Potential Impact
The vulnerability allows attackers to control the value returned by ctx.hostname by sending a malformed Host header with an '@' symbol. This can lead to host header injection attacks, potentially impacting URL generation, password reset links, email verification URLs, and routing decisions in affected applications. The CVSS score is 7.5 (high severity), indicating a significant risk if exploited. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available in Koa versions 2.16.4 and 3.1.2. Users should upgrade to at least these versions to remediate the vulnerability. No additional vendor advisory indicates alternative mitigations or that no action is required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-02-25T03:24:57.792Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-27959","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:7249","vendor":"Red Hat"}]
Threat ID: 699fabd8b7ef31ef0b7dea15
Added to database: 02/26/2026, 02:11:36 UTC
Last enriched: 07/15/2026, 08:45:52 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 233
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.