CVE-2025-25200
Koa has Inefficient Regular Expression Complexity
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Koa has Inefficient Regular Expression Complexity
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
- Record
CVE-2025-25200- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2025-4086
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
- Record
EUVD-2025-4086- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-593f-38f6-jp5m
Inefficient Regular Expression Complexity in koa
Summary
Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.
PoC
Coming soon.
Impact
This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.
- Record
GHSA-593f-38f6-jp5m- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
NVD
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
- Record
CVE-2025-25200- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSV
Koa has Inefficient Regular Expression Complexity
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
- Record
CVE-2025-25200- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVGHSA-593f-38f6-jp5m
Inefficient Regular Expression Complexity in koa
Summary
Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.
PoC
Coming soon.
Impact
This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.
- Record
GHSA-593f-38f6-jp5m- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVCLSA-2026-1787657292 No score
TuxCare security update for koa (4 CVEs)
TuxCare rebuilt koa to address 4 CVEs. Fixed in 2.15.3-tuxcare.1.
- Record
CLSA-2026-1787657292- Updated
- 2026-11-02
OSVCLSA-2026-1792779347 No score
TuxCare security update for koa (4 CVEs)
TuxCare rebuilt koa to address 4 CVEs. Fixed in 2.15.4-tuxcare.1.
- Record
CLSA-2026-1792779347- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2025-25200 No score
CVE-2025-25200 in koa - Patched by Root
Root has patched CVE-2025-25200 in the koa package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2025-25200- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
koanpm |
2.0.0 up to 2.15.4 | 2.15.4 |
koanpm |
3.0.0-alpha.0 up to 3.0.0-alpha.3 | 3.0.0-alpha.3 |
koanpm |
1.0.0 up to 1.7.1 | 1.7.1 |
koanpm |
before 0.21.2 | 0.21.2 |
koaTuxCare:npm From an advisory covering 4 CVEs |
2.15.3-tuxcare.0 up to 2.15.3-tuxcare.1, plus listed versions 2.15.3 |
2.15.3-tuxcare.1 |
koaTuxCare:npm From an advisory covering 4 CVEs |
2.15.4-tuxcare.0 up to 2.15.4-tuxcare.1, plus listed versions 2.15.4 |
2.15.4-tuxcare.1 |
koaRoot:npm |
before 2.15.3-aikido.2 | 2.15.3-aikido.22.11.0-aikido.22.15.3-aikido.12.11.0-aikido.12.15.4-aikido.22.15.4-aikido.32.15.4-aikido.4 |
@rootio/koaRoot:npm |
before 2.15.3-root.io.2 | 2.15.3-root.io.22.11.0-root.io.22.15.3-root.io.12.11.0-root.io.12.15.4-root.io.12.15.4-root.io.22.15.4-root.io.32.15.4-root.io.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | dwictor0/PoC-CVE-2025-25200 | 2026-03-22 |
| PoC in GitHub | gduma-phData/patch-CVE-2025-25200 | 2026-08-24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-25200 is a critical vulnerability (CVSS 9.2) in Koajs Koa, published February 12, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in koa 2.15.4.
References
github.com/koajs/koa/security/advisories/GHSA-593f-38f6-jp5m