Vulnerability Description
Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Koajs | Koa | < 2.16.14 |
Related Weaknesses (CWE)
References
- https://github.com/koajs/koa/commit/55ab9bab044ead4e82c70a30a4f9dc0fc9c1b6dfPatch
- https://github.com/koajs/koa/commit/b76ddc01fdb703e51652b0fd131d16394cadcfebPatch
- https://github.com/koajs/koa/security/advisories/GHSA-7gcc-r8m5-44qmExploitVendor Advisory
FAQ
What is CVE-2026-27959?
CVE-2026-27959 is a vulnerability with a CVSS score of 7.5 (HIGH). Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before th...
How severe is CVE-2026-27959?
CVE-2026-27959 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27959?
Check the references section above for vendor advisories and patch information. Affected products include: Koajs Koa.