Inefficient Regular Expression Complexity
CVE-2025-25200
Summary
Koa is expressive middleware for Node.js using `ES2017` async functions. Versions prior to 0.21.2, 1.x prior to 1.7.1, 2.x prior to 2.15.4, and 3.x prior to 3.0.0-alpha.3. Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service (DoS) attack.
- LOW
- NETWORK
- NONE
- NONE
CWE-1333 - Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
References
Advisory Timeline
- Published
