CVE-2026-27959: Koajs Koa Host Header Injection Vulnerability

CVE-2026-27959 Overview

CVE-2026-27959 is a Host header injection vulnerability in Koa, a Node.js middleware framework using ES2017 async functions. The flaw exists in the ctx.hostname API, which performs naive parsing of the HTTP Host header. Koa extracts everything before the first colon without validating the input against RFC 3986 hostname syntax. When a malformed Host header containing an @ symbol is received, ctx.hostname returns an attacker-controlled value. Applications using ctx.hostname to construct URLs, password reset links, email verification URLs, or routing decisions become exposed to Host header injection attacks. Versions 3.1.2 and 2.16.4 remediate the issue.

Critical Impact
Attackers can manipulate ctx.hostname output to poison generated URLs, enabling phishing redirects, account takeover via password reset link hijacking, and cache poisoning against downstream consumers.

Affected Products

Koa versions prior to 2.16.4 (2.x branch)
Koa versions prior to 3.1.2 (3.x branch)
Node.js applications relying on ctx.hostname for URL generation or routing

Discovery Timeline

2026-02-26 - CVE-2026-27959 published to NVD
2026-02-28 - Last updated in NVD database

Technical Details for CVE-2026-27959

Vulnerability Analysis

Koa exposes the ctx.hostname getter as a convenience for reading the request hostname. The implementation splits the Host header on the first colon and returns the left portion as the hostname. The function does not enforce RFC 3986 host syntax, so values containing user-info delimiters such as @ are accepted without validation. An attacker who sends Host: attacker.tld@evil.com causes ctx.hostname to return evil.com, bypassing the developer's expectation that the value reflects the server's true hostname. The weakness is classified as [CWE-20] Improper Input Validation.

Root Cause

The root cause is missing structural validation of the Host header before returning the parsed substring. The parser treats the header as opaque text rather than a structured URI authority component. Because the @ character is reserved as the user-info delimiter in URI authorities, a compliant parser must reject or strip everything preceding it. Koa's prior logic instead truncated only on :, leaving injected authority segments intact in the returned hostname string.

Attack Vector

The attack is network-reachable and requires no authentication or user interaction. An attacker sends a crafted HTTP request with a malicious Host header to a Koa-based service. Any application code that interpolates ctx.hostname into outbound URLs, such as password reset emails, OAuth redirect URIs, or webhook callbacks, will embed the attacker-controlled domain. Victims clicking these links are routed to attacker infrastructure, where credentials, reset tokens, or session material can be harvested. Downstream caches that key on path while trusting the host can also be poisoned.

The upstream fix replaces naive splitting with strict authority parsing. Review the Koa security advisory GHSA-7gcc-r8m5-44qm and the corrective commits 55ab9ba and b76ddc0 for implementation details.

Detection Methods for CVE-2026-27959

Indicators of Compromise

HTTP requests where the Host header contains an @ character or multiple : delimiters
Outbound emails or webhook payloads containing reset or verification URLs pointing to unexpected domains
Access logs showing identical request paths served with anomalous Host values across short time windows

Detection Strategies

Inspect web server, reverse proxy, and application logs for Host headers that fail RFC 3986 authority validation
Enforce an allowlist of expected Host values at the edge and alert on deviations
Correlate password reset and account verification email events with the originating request's Host header to detect mismatches

Monitoring Recommendations

Capture the raw Host header in application telemetry alongside generated URLs for audit
Add WAF rules that reject requests where the Host header contains @ or non-hostname characters
Monitor email delivery systems for spikes in reset links pointing to domains outside the production allowlist

How to Mitigate CVE-2026-27959

Immediate Actions Required

Upgrade Koa to version 3.1.2 on the 3.x branch or 2.16.4 on the 2.x branch
Audit application code for usage of ctx.hostname, ctx.host, and ctx.origin in URL generation paths
Configure a trusted hostname allowlist and reject requests with unrecognized Host headers at the proxy or middleware layer
Rotate any password reset or email verification tokens issued during the exposure window

Patch Information

The maintainers shipped fixes in Koa 3.1.2 and 2.16.4. The patches harden Host header parsing so that authority components containing user-info segments are rejected or normalized. Review the GitHub Security Advisory GHSA-7gcc-r8m5-44qm and the fix commit 55ab9ba for the authoritative change set.

Workarounds

Replace ctx.hostname with a hardcoded canonical hostname read from server configuration when generating outbound URLs
Validate the Host header against a static allowlist in middleware before request processing continues
Deploy a reverse proxy rule that strips or rewrites malformed Host headers before they reach the Koa application

bash

# Upgrade Koa to a patched release
npm install koa@3.1.2
# or for the 2.x branch
npm install koa@2.16.4