Input validation error in koa - CVE-2026-27959
Published: November 9, 2026
Vulnerability identifier: #VU162936
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-27959
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to poison password reset URLs generated by Koa applications.
The vulnerability exists due to missing hostname validation in ctx.hostname, which splits malformed Host headers containing @ at the first colon when those headers reach the application. An unauthenticated remote attacker can submit such headers to applications using ctx.hostname for reset links, directing victims to an attacker-controlled site that captures reset tokens when victims click.
Affected software
koa
How to mitigate CVE-2026-27959
Install security update from vendor's website.
koa - addressed in versions 2.16.4, 3.1.2