ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27959

Koa is middleware for Node.js using ES2017 async functions.

Published Feb 26, 2026 · updated Jul 15, 2026 · koajs koa

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a symbol is received, returns - an attacker-controlled value. Applications using for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 26, 2026 · NIST NVD

    Detected

    Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a symbol is received, returns - an attacker-controlled value. Applications using for URL gener

  2. Jul 15, 2026 · NIST NVD

    Updated

    Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a symbol is received, returns - an attacker-controlled value. Applications using for URL gener

Affected

  • cpe koajs/koaversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-27959

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-27959

    Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax.

    nvd.nist.gov

References