CVE-2025-25200
Published: 12 February 2025
Summary
CVE-2025-25200 is a critical-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability in Koajs Koa. Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 33.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-25200 is a denial-of-service vulnerability in Koa, an expressive middleware framework for Node.js that uses ES2017 async functions. The issue affects Koa versions prior to 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, stemming from an inefficient regular expression (CWE-1333) used to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This "evil regex" enables a ReDoS attack, consuming excessive CPU resources. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and was published on 2025-02-12.
Any unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP requests containing malicious payloads in the X-Forwarded-Proto or X-Forwarded-Host headers. The low attack complexity and lack of required privileges or user interaction make it highly accessible over the network. Successful exploitation results in significant resource exhaustion, leading to denial of service on the affected Koa application.
Mitigation requires upgrading to Koa versions 0.21.2, 1.7.1, 2.15.4, or 3.0.0-alpha.3, which address the issue via commits documented in the project's GitHub repository, including changes to the regex parsing logic in lib/request.js at lines 259 and 404. Relevant patches are available at https://github.com/koajs/koa/commit/5054af6e31ffd451a4151a1fe144cef6e5d0d83c, https://github.com/koajs/koa/commit/5f294bb1c7c8d9c61904378d250439a321bffd32, and https://github.com/koajs/koa/commit/93fe903fc966635a991bcf890cfc3427d33a1a08.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4086
Vulnerability details
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service…
more
attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
ReDoS vulnerability in HTTP header parsing enables resource exhaustion DoS on the application via crafted requests, directly mapping to application/system exploitation for denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and correction of software flaws like the ReDoS vulnerability in Koa's regex parsing of HTTP headers.
Directly protects against denial-of-service attacks, including CPU exhaustion from malicious X-Forwarded-Proto and X-Forwarded-Host headers.
Requires validation of untrusted HTTP header inputs to mitigate exploitation of the inefficient regex parsing.