CVE-2026-27959 Koa has Host Header Injection via `ctx.hostname`

What is CVE-2026-27959?

CVE-2026-27959 is a high-severity vulnerability in koajs koa, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.

Weakness: CWE-20

Which versions are affected by CVE-2026-27959?

4 open source packages ship an affected version, including koa. It affects 1 product.

Products include Koajs Koa.

How do I fix CVE-2026-27959?

Upgrade koa to a fixed version for your release line: 2.16.4 or 3.1.2.

Is CVE-2026-27959 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27959 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in koajs koa

• CVE-2025-25200 Koa has Inefficient Regular Expression Complexity Critical 9.2
• CVE-2025-8129 KoaJS Koa HTTP Header response.js back redirect Medium 5.1
• CVE-2025-32379 XSS at ctx.redirect() function in Koajs Medium 5.0
• CVE-2025-62595 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2026-1788264598, GHSA-7gcc-r8m5-44qm, ROOT-APP-NPM-CVE-2026-27959.