# koa (npm) vulnerabilities 5 known vulnerabilities (1 critical, 1 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.3.0 (Nov 3, 2026): no advisory affects it - Newest unaffected release: 3.3.0 (Nov 3, 2026), the latest release - Weekly downloads: 9.9M - Dependents: 1,544 - Releases: 126 since 0.0.1 (Nov 6, 2013) - Registry: https://www.npmjs.com/package/koa - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-27959: 0.0.1 to 2.16.3 (2.16.4 is outside it); 3.0.0 to 3.1.1 (3.1.2 is outside it) - CVE-2025-62595: 2.16.2 (2.16.3 is outside it); 3.0.1 to 3.0.2 (3.0.3 is outside it) - CVE-2025-8129: 2.0.0 to 2.16.1 (2.16.2 is outside it); 3.0.0-alpha.0 to 3.0.0 (3.0.1 is outside it) - CVE-2025-32379: 0.0.1 to 2.16.0 (2.16.1 is outside it); 3.0.0-alpha.1 to 3.0.0-alpha.4 (3.0.0-alpha.5 is outside it) - CVE-2025-25200: 0.0.1 to 0.21.1 (0.21.2 is outside it); 1.0.0 to 1.7.0 (1.7.1 is outside it); 2.0.0 to 2.15.3 (2.15.4 is outside it); 3.0.0-alpha.0 to 3.0.0-alpha.2 (3.0.0-alpha.3 is outside it) ## Advisories (5) ### [CVE-2026-27959](https://cve.now/CVE-2026-27959): Koa has Host Header Injection via \`ctx.hostname\` - Severity: High 7.5 - Published: Feb 26, 2026 - Affected: from 3.0.0, fixed in 3.1.2; fixed in 2.16.4. - Fixed in 2.16.4 (released Feb 25, 2026, 1 day before disclosure) and 3.1.2 (released Feb 25, 2026, 1 day before disclosure). - The latest release, 3.3.0, is not affected. - 48% of koa downloads last week were affected versions (5.6M). ### [CVE-2025-62595](https://cve.now/CVE-2025-62595): Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic - Severity: Medium 4.3 - Published: Oct 21, 2025 - Affected: from 3.0.1, fixed in 3.0.3; from 2.16.2, fixed in 2.16.3. - Fixed in 2.16.3 (released Oct 18, 2025, 3 days before disclosure) and 3.0.3 (released Oct 18, 2025, 3 days before disclosure). - The latest release, 3.3.0, is not affected. - 8.6% of koa downloads last week were affected versions (995K). ### [CVE-2025-8129](https://cve.now/CVE-2025-8129): KoaJS Koa HTTP Header response.js back redirect - Severity: Medium 5.1 - Published: Jul 25, 2025 - Affected: from 2.0.0, fixed in 2.16.2; from 3.0.0-alpha.0, fixed in 3.0.1. - Fixed in 2.16.2 (released Jul 30, 2025, 5 days after disclosure) and 3.0.1 (released Jul 27, 2025, 2 days after disclosure). - The latest release, 3.3.0, is not affected. - 28% of koa downloads last week were affected versions (3.3M). ### [CVE-2025-32379](https://cve.now/CVE-2025-32379): XSS at ctx.redirect() function in Koajs - Severity: Medium 5.0 - Published: Apr 9, 2025 - Affected: fixed in 2.16.1; from 3.0.0-alpha.1, fixed in 3.0.0-alpha.5. - Fixed in 2.16.1 (released Apr 6, 2025, 3 days before disclosure) and 3.0.0-alpha.5 (released Apr 6, 2025, 3 days before disclosure). - The latest release, 3.3.0, is not affected. - 21% of koa downloads last week were affected versions (2.5M). ### [CVE-2025-25200](https://cve.now/CVE-2025-25200): Koa has Inefficient Regular Expression Complexity - Severity: Critical 9.2 - Published: Feb 12, 2025 - Affected: from 2.0.0, fixed in 2.15.4; from 3.0.0-alpha.0, fixed in 3.0.0-alpha.3; from 1.0.0, fixed in 1.7.1; fixed in 0.21.2. - Fixed in 0.21.2 (released Feb 11, 2025, 1 day before disclosure), 1.7.1 (released Feb 11, 2025, 1 day before disclosure), 2.15.4 (released Feb 11, 2025, 1 day before disclosure) and 1 other version. - The latest release, 3.3.0, is not affected. - 16% of koa downloads last week were affected versions (1.9M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/koa Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.