Inefficient regular expression complexity in koa - CVE-2025-25200
Published: May 9, 2025
Vulnerability identifier: #VU108849
CSH Severity: Critical
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H]
CVE-ID: CVE-2025-25200
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Affected software
koa
Planning Analytics Local
Planning Analytics Local
How to mitigate CVE-2025-25200
Install updates from vendor's website.
koa - addressed in versions 0.21.2, 1.7.1, 2.15.4, 3.0.0.3
Planning Analytics Local - addressed in versions 2.0.0.103, 2.1.10
Planning Analytics Local - addressed in versions 2.0.0.103, 2.1.10
External References
- https://github.com/koajs/koa/blob/master/lib/request.js#L259
- https://github.com/koajs/koa/blob/master/lib/request.js#L404
- https://github.com/koajs/koa/commit/5054af6e31ffd451a4151a1fe144cef6e5d0d83c
- https://github.com/koajs/koa/commit/5f294bb1c7c8d9c61904378d250439a321bffd32
- https://github.com/koajs/koa/commit/93fe903fc966635a991bcf890cfc3427d33a1a08
- https://github.com/koajs/koa/releases/tag/2.15.4
- https://github.com/koajs/koa/security/advisories/GHSA-593f-38f6-jp5m