CVE-2025-25200

The vulnerability concerns parsing HTTP headers `X-Forwarded-Proto` and `X-Forwarded-Host` using an 'evil regex' — a regular expression vulnerable to catastrophic backtracking. An attacker can send a specially crafted HTTP request containing an appropriately constructed value of these headers. Processing such a request causes exponential lengthening of the execution time of the regular expression, leading to blocking of the Node.js thread and unavailability of the application.

An unauthenticated attacker can cause a denial of service (DoS) both in the context of the application itself and the system on which it runs, effectively preventing the handling of legitimate requests.

Koa should be updated to version 0.21.2, 1.7.1, 2.15.4, or 3.0.0-alpha.3 (depending on the branch used), in which the issue has been fixed. Additionally, consider filtering or validating `X-Forwarded-Proto` and `X-Forwarded-Host` headers at the reverse proxy or firewall level before passing them to the application.

Koa (koajs/koa) in versions prior to 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3