7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27959

CVE-2026-27959: Koa has Host Header Injection via `ctx.hostname`

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's ctx.hostname API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a @ symbol is received, ctx.hostname returns evil[.]com - an attacker-controlled value. Applications using ctx.hostname for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27959

CVE-2026-27959:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
koa	npm	>= 3.0.0, < 3.1.2	3.1.2
koa	npm	< 2.16.4	2.16.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from improper input validation of the HTTP Host header (and its alternatives X-Forwarded-Host and :authority) within the request.host getter in Koa's lib/request.js. The getter did not sanitize the header value, allowing strings containing userinfo (e.g., user@host) to be processed.

The primary vulnerable function is request.hostname, which consumed the output of request.host. It naively split the host string at the first colon, causing an attacker-controlled value to be interpreted as the hostname. For example, a Host header of evil.com:fake@legitimate.com would cause request.hostname to return evil.com.

This flaw allows for various attacks, including password reset poisoning, cache poisoning, and SSRF, where applications use ctx.hostname to generate URLs. The request.origin getter was also affected as it used the unvalidated host value to construct the origin URL.

The patch addresses the root cause in the request.host getter by detecting the presence of an @ symbol and using the URL API to correctly parse the host, effectively stripping any malicious userinfo before the value is used by request.hostname or request.origin.

Vulnerable functions

request.hostname

lib/request.js

This getter performs naive parsing of the value from the `host` getter. It splits the host string by the first colon (`:`) and returns the first part. When a malicious `Host` header like `evil.com:fake@legitimate.com` is provided, the `host` getter returns this string, and `hostname` incorrectly extracts `evil.com` as the hostname, leading to host header injection.

request.host

lib/request.js

This getter is the source of the vulnerability. It retrieves the `Host`, `X-Forwarded-Host`, or `:authority` header but fails to validate or sanitize it. It allows malformed host values containing userinfo (e.g., `evil.com:fake@legitimate.com`) to be passed to other properties like `hostname`. The patch fixes this by using the `URL` constructor to correctly parse the host when an `@` symbol is present.

request.origin

lib/request.js

This getter is vulnerable because it directly uses the value of the `request.host` getter, which may be a malformed host string. It concatenates the protocol with the unsanitized host, creating a potentially malicious URL like `http://evil.com:fake@legitimate.com`. This can lead to open redirects or credential leakage if the URL is used in redirects or logged.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.