CVE-2026-27959: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27959 is a Host Header Injection vulnerability in Koa, a Node.js middleware framework using ES2017 async functions. The flaw exists in Koa's ctx.hostname API, which naively parses the HTTP Host header by splitting on the first colon without validating conformance to RFC 3986 hostname syntax. When a malformed Host header containing an @ symbol is received (e.g., evil.com:fake@legitimate.com), ctx.hostname returns the attacker-controlled value evil.com. Affected versions are Koa < 2.16.4 and Koa 3.0.0–3.1.1; patched versions are 2.16.4 and 3.1.2. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20) in Koa's hostname getter in lib/request.js, which calls host.split(':', 1)[0] without checking whether the result is a valid RFC 3986 hostname. The @ character is the userinfo delimiter in URI authority components and is explicitly forbidden in the host portion, but Koa's parser does not account for this. An attacker sends a crafted HTTP request with a Host header such as evil.com:fake@legitimate.com:3000; Koa splits on the first : and returns evil.com as the hostname. The same flaw affects ctx.origin (which concatenates protocol and the raw malformed host), the X-Forwarded-Host header when app.proxy = true, and the HTTP/2 :authority pseudo-header. The fix (commits 55ab9ba and b76ddc0) adds a check for @ in the host value and uses Node's URL parser to correctly extract the host portion (Github Advisory, Patch Commit).

The primary impact is a high-integrity violation: attackers can inject an arbitrary hostname into any URL generated by the application using ctx.hostname or ctx.origin, with no confidentiality or availability impact directly. The most severe attack scenario is password reset poisoning — an attacker triggers a password reset for a victim's account with a malicious Host header, causing the server to generate a reset link pointing to the attacker's domain; the victim clicks the link and the token is exfiltrated, enabling full account takeover. Additional scenarios include email verification bypass, OAuth/SSO callback manipulation leading to token theft, web cache poisoning that serves malicious URLs to all users, and SSRF via manipulated internal routing decisions (Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating the attack with a simple curl command requiring no authentication or special privileges. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.054%–0.125%, indicating a low but non-negligible probability of exploitation in the near term. Exploitation requires that the malicious Host header reach the Koa application directly (no reverse proxy, misconfigured proxy, or proxy trust enabled with app.proxy = true) (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Node.js applications built on Koa (versions < 2.16.4 or 3.0.0–3.1.1) that expose password reset, email verification, OAuth callback, or URL-generation endpoints. Check for direct exposure (no reverse proxy) or misconfigured proxy settings.
2. Identify target endpoint: Locate an endpoint that uses ctx.hostname or ctx.origin to construct URLs sent to users (e.g., /forgot-password, /verify-email).
3. Craft malicious Host header: Construct a Host header in the format evil.com:fake@legitimate.com:PORT, where evil.com is the attacker-controlled domain and legitimate.com is the real server hostname.
4. Send poisoned request: Submit an HTTP request to the target endpoint with the malicious header:

   curl -H "Host: evil.com:fake@legitimate.com:3000" http://legitimate.com/forgot-password

5. Observe poisoned URL generation: The server generates a URL such as http://evil.com/reset?token=SECRET using ctx.hostname, which resolves to evil.com.
6. Deliver to victim: The poisoned reset/verification link is emailed to the victim. When the victim clicks it, the token is sent to the attacker's server.
7. Account takeover: The attacker uses the captured token to reset the victim's password or complete account verification on the legitimate service (Github Advisory).

• Network: Inbound HTTP requests with Host headers containing @ symbols (e.g., Host: evil.com:fake@legitimate.com); requests to password reset or email verification endpoints from unexpected IPs with anomalous Host values; outbound connections from the application server to unexpected external domains shortly after such requests.
• Logs: Web server or application access logs showing Host header values containing @ characters on sensitive endpoints (/forgot-password, /reset, /verify); log entries where the generated reset URL domain does not match the application's configured domain.
• Application Behavior: Password reset or verification emails containing URLs pointing to unexpected external domains; ctx.hostname values in application debug logs that differ from the server's actual hostname.
• WAF/Proxy Alerts: WAF rules or reverse proxy logs flagging malformed Host headers with userinfo components (@ delimiter) as per RFC 7230 violations (Github Advisory).

Upgrade Koa to version 2.16.4 (for the v2 branch) or 3.1.2 (for the v3 branch), which fix the issue by using Node's URL parser to correctly extract the host portion when an @ symbol is detected in the Host header. As an interim workaround, deploy a Web Application Firewall (WAF) rule to reject or sanitize Host headers containing @ symbols before they reach the Koa application, or configure a reverse proxy (e.g., nginx, HAProxy) to enforce strict Host header validation. Applications using ctx.hostname in security-sensitive contexts (password reset, email verification, OAuth) should add explicit allowlist validation of the hostname against a known-good value at the application level (Github Advisory, Red Hat Bugzilla, IBM Advisory).

The vulnerability was reported by security researcher p80n-sec and published by Koa maintainer fengmk2 on February 25, 2026. A Reddit thread in r/websecurityresearch discussed the CVE shortly after disclosure, and a LinkedIn post also circulated the advisory. Endor Labs published a threat intelligence write-up on the vulnerability. IBM acknowledged the impact on IBM API Connect and issued multiple advisories. Community reaction has been moderate, with coverage across vulnerability tracking platforms (VulnDB, CVEFeed, CIRCL) and security news aggregators (Endor Labs, IBM Advisory, Github Advisory).