CVE-2026-27959
📋 TL;DR
This vulnerability in Koa.js allows attackers to inject malicious hostnames via specially crafted HTTP Host headers containing '@' symbols. Applications using ctx.hostname for security-sensitive operations like URL generation, password reset links, or routing decisions are vulnerable to host header injection attacks. All Koa.js applications using affected versions are at risk.
💻 Affected Systems
- Koa.js
📦 What is this software?
Koa by Koajs
Koa by Koajs
⚠️ Risk & Real-World Impact
Worst Case
Attackers could redirect password reset or email verification links to malicious domains, leading to account takeover, phishing attacks, or session hijacking.
Likely Case
Attackers could manipulate generated URLs to redirect users to malicious sites or bypass security controls that rely on hostname validation.
If Mitigated
With proper input validation and security controls, the impact is limited to potential logging anomalies or minor functionality issues.
🎯 Exploit Status
Exploitation requires sending a malformed Host header with '@' symbol. Public proof-of-concept exists in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.16.4 or 3.1.2
Vendor Advisory: https://github.com/koajs/koa/security/advisories/GHSA-7gcc-r8m5-44qm
Restart Required: Yes
Instructions:
1. Update Koa.js package using npm: 'npm update koa' 2. Verify version is 2.16.4+ or 3.1.2+ 3. Restart Node.js application
🔧 Temporary Workarounds
Input Validation Middleware
allAdd middleware to validate Host header before Koa processes it
app.use(async (ctx, next) => { if (ctx.request.host.includes('@')) { ctx.throw(400, 'Invalid Host header'); } await next(); })
🧯 If You Can't Patch
- Implement reverse proxy with strict Host header validation
- Add application-level validation for all ctx.hostname usage
🔍 How to Verify
Check if Vulnerable:
Check if application uses ctx.hostname and test with Host header containing '@' symbolCheck Version:
npm list koaVerify Fix Applied:
Test with malformed Host header containing '@' - should return proper error or sanitized value📡 Detection & Monitoring
Log Indicators:
- HTTP requests with Host headers containing '@' symbols
- Unexpected hostname values in application logs
Network Indicators:
- HTTP requests with malformed Host headers
- Unusual redirect patterns
SIEM Query:
http.request.headers.host CONTAINS '@'