Skip to main content
cve.nowby Sazabi
← npm
npmPackage

koa

5 known vulnerabilities (1 critical, 1 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
3.3.0 (Nov 3, 2026): no advisory affects it
Newest unaffected release
3.3.0 (Nov 3, 2026), the latest release
Advisories
5 · 1 critical, 1 high, 3 medium
Weekly downloads
9.9M
Dependents
1,544
Releases
126 since 0.0.1 (Nov 6, 2013)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-27959
    Affects 0.0.1 to 2.16.3 (2.16.4 is outside it); 3.0.0 to 3.1.1 (3.1.2 is outside it)
  • CVE-2025-62595
    Affects 2.16.2 (2.16.3 is outside it); 3.0.1 to 3.0.2 (3.0.3 is outside it)
  • CVE-2025-8129
    Affects 2.0.0 to 2.16.1 (2.16.2 is outside it); 3.0.0-alpha.0 to 3.0.0 (3.0.1 is outside it)
  • CVE-2025-32379
    Affects 0.0.1 to 2.16.0 (2.16.1 is outside it); 3.0.0-alpha.1 to 3.0.0-alpha.4 (3.0.0-alpha.5 is outside it)
  • CVE-2025-25200
    Affects 0.0.1 to 0.21.1 (0.21.2 is outside it); 1.0.0 to 1.7.0 (1.7.1 is outside it); 2.0.0 to 2.15.3 (2.15.4 is outside it); 3.0.0-alpha.0 to 3.0.0-alpha.2 (3.0.0-alpha.3 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • Koa has Host Header Injection via `ctx.hostname`

    Affected: from 3.0.0, fixed in 3.1.2; fixed in 2.16.4.

    Fixed in 2.16.4 (released Feb 25, 2026, 1 day before disclosure) and 3.1.2 (released Feb 25, 2026, 1 day before disclosure).

    The latest release, 3.3.0, is not affected.

    48% of koa downloads last week were affected versions (5.6M).

  • CVE-2025-62595Medium 4.3

    Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic

    Affected: from 3.0.1, fixed in 3.0.3; from 2.16.2, fixed in 2.16.3.

    Fixed in 2.16.3 (released Oct 18, 2025, 3 days before disclosure) and 3.0.3 (released Oct 18, 2025, 3 days before disclosure).

    The latest release, 3.3.0, is not affected.

    8.6% of koa downloads last week were affected versions (995K).

  • CVE-2025-8129Medium 5.1

    KoaJS Koa HTTP Header response.js back redirect

    Affected: from 2.0.0, fixed in 2.16.2; from 3.0.0-alpha.0, fixed in 3.0.1.

    Fixed in 2.16.2 (released Jul 30, 2025, 5 days after disclosure) and 3.0.1 (released Jul 27, 2025, 2 days after disclosure).

    The latest release, 3.3.0, is not affected.

    28% of koa downloads last week were affected versions (3.3M).

  • CVE-2025-32379Medium 5.0

    XSS at ctx.redirect() function in Koajs

    Affected: fixed in 2.16.1; from 3.0.0-alpha.1, fixed in 3.0.0-alpha.5.

    Fixed in 2.16.1 (released Apr 6, 2025, 3 days before disclosure) and 3.0.0-alpha.5 (released Apr 6, 2025, 3 days before disclosure).

    The latest release, 3.3.0, is not affected.

    21% of koa downloads last week were affected versions (2.5M).

  • CVE-2025-25200Critical 9.2

    Koa has Inefficient Regular Expression Complexity

    Affected: from 2.0.0, fixed in 2.15.4; from 3.0.0-alpha.0, fixed in 3.0.0-alpha.3; from 1.0.0, fixed in 1.7.1; fixed in 0.21.2.

    Fixed in 0.21.2 (released Feb 11, 2025, 1 day before disclosure), 1.7.1 (released Feb 11, 2025, 1 day before disclosure), 2.15.4 (released Feb 11, 2025, 1 day before disclosure) and 1 other version.

    The latest release, 3.3.0, is not affected.

    16% of koa downloads last week were affected versions (1.9M).