SB20261109160 - Input validation error in koa

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109160

SB20261109160 - Input validation error in koa

Published: November 9, 2026

Security Bulletin ID SB20261109160
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Input validation error (CVE-ID: CVE-2026-27959)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to poison password reset URLs generated by Koa applications.

The vulnerability exists due to missing hostname validation in ctx.hostname, which splits malformed Host headers containing @ at the first colon when those headers reach the application. An unauthenticated remote attacker can submit such headers to applications using ctx.hostname for reset links, directing victims to an attacker-controlled site that captures reset tokens when victims click.


Remediation

Install update from vendor's website.

References