CVE-2025-25200

CVE-2025-25200 is a denial-of-service vulnerability in Koa, an expressive middleware framework for Node.js that uses ES2017 async functions. The issue affects Koa versions prior to 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, stemming from an inefficient regular expression (CWE-1333) used to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This "evil regex" enables a ReDoS attack, consuming excessive CPU resources. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and was published on 2025-02-12.

Any unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP requests containing malicious payloads in the X-Forwarded-Proto or X-Forwarded-Host headers. The low attack complexity and lack of required privileges or user interaction make it highly accessible over the network. Successful exploitation results in significant resource exhaustion, leading to denial of service on the affected Koa application.

Mitigation requires upgrading to Koa versions 0.21.2, 1.7.1, 2.15.4, or 3.0.0-alpha.3, which address the issue via commits documented in the project's GitHub repository, including changes to the regex parsing logic in lib/request.js at lines 259 and 404. Relevant patches are available at https://github.com/koajs/koa/commit/5054af6e31ffd451a4151a1fe144cef6e5d0d83c, https://github.com/koajs/koa/commit/5f294bb1c7c8d9c61904378d250439a321bffd32, and https://github.com/koajs/koa/commit/93fe903fc966635a991bcf890cfc3427d33a1a08.