What is the CVSS score of CVE-2026-27959?

CVE-2026-27959 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Node.js are affected by CVE-2026-27959?

Koa framework versions prior to 3.1.2 and 2.16.4 contain a hostname parsing vulnerability that could allow attackers to bypass security controls or manipulate application behavior through crafted…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27959?

Yes, a public proof-of-concept exploit is available for CVE-2026-27959. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-27959?

Within 24 hours: Identify all applications using Koa and determine which versions are deployed. Within 7 days: Apply vendor patches to upgrade Koa to version 3.1.2 or 2.16.4 or later across all production and non-production environments. Within 30 days: Conduct application testing to validate patches and verify no regressions in Host header handling functionality.

Node.js CVE-2026-27959

HIGH

Improper Input Validation (CWE-20)

2026-02-26 security-advisories@github.com

GHSA-7gcc-r8m5-44qm

Node.js Code Injection Koa Koajs

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 28, 2026 - 00:55 vuln.today

Public exploit code

Patch released

Feb 28, 2026 - 00:55 nvd

Patch available

CVE Published

Feb 26, 2026 - 02:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on koa (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's ctx.hostname API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a @ symbol is received, ctx.hostname returns evil[.]com - an attacker-controlled value. Applications using ctx.hostname for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.

AnalysisAI

Host header injection in Koa's ctx.hostname API (versions prior to 2.16.4 and 3.1.2) allows remote attackers to inject arbitrary hostnames through malformed Host headers containing @ symbols, affecting applications that use this API for security-sensitive operations like URL generation, password reset links, and email verification. Public exploit code exists for this vulnerability. Applications relying on ctx.hostname for routing decisions or generating user-facing URLs are at risk of credential theft, account compromise, and phishing attacks.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects Koa. Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's ctx.hostname API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a @ symbol is received, ctx.hostname returns evil[.]com - an attacker-controlled value. Applications using ctx.hostname for URL generation, password reset links, email ver