CVE-2025-25200

Katalog CVE

CVSS 7.5 · High EPSS 0,84%

Kerentanan Inefficient Regular Expression Complexity pada koajs koa. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.

Rincian

Terbit di NVD

12 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,84% peluang dieksploitasi; lebih tinggi dari 56,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/koajs/koa/security/advisories/GHSA-593f-38f6-jp5m advisory vendor
• https://github.com/koajs/koa/commit/5054af6e31ffd451a4151a1fe144cef6e5d0d83c patch
• https://github.com/koajs/koa/commit/5f294bb1c7c8d9c61904378d250439a321bffd32 patch
• https://github.com/koajs/koa/commit/93fe903fc966635a991bcf890cfc3427d33a1a08 patch
• https://github.com/koajs/koa/blob/master/lib/request.js#L259 product
• https://github.com/koajs/koa/blob/master/lib/request.js#L404 product
• https://github.com/koajs/koa/releases/tag/2.15.4 release notes