GHSA-593f-38f6-jp5m

Source

https://github.com/advisories/GHSA-593f-38f6-jp5m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-593f-38f6-jp5m/GHSA-593f-38f6-jp5m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-593f-38f6-jp5m

Aliases

CVE-2025-25200

Published

2025-02-12T19:23:09Z

Modified

2025-02-12T19:27:07.225487Z

Severity

9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator

Summary

Inefficient Regular Expression Complexity in koa

Details

Summary

Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.

PoC

Coming soon.

Impact

This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.

Database specific

{
    "github_reviewed_at": "2025-02-12T19:23:09Z",
    "github_reviewed": true,
    "severity": "CRITICAL",
    "nvd_published_at": "2025-02-12T18:15:28Z",
    "cwe_ids": [
        "CWE-1333"
    ]
}

References