Exploitation Summary
EIP tracks 1 public exploit for CVE-2025-25200. PoCs published by dwictor0.
AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2025-25200, a Regular Expression Denial of Service (ReDoS) vulnerability in the Koa framework. The exploit demonstrates the vulnerability by sending a crafted HTTP request with a malicious 'X-Forwarded-For' header to a vulnerable Koa server, causing excessive processing time due to backtracking in the regex engine.
Description
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
Exploits (1)
This repository contains a functional proof-of-concept for CVE-2025-25200, a Regular Expression Denial of Service (ReDoS) vulnerability in the Koa framework. The exploit demonstrates the vulnerability by sending a crafted HTTP request with a malicious 'X-Forwarded-For' header to a vulnerable Koa server, causing excessive processing time due to backtracking in the regex engine.
References (7)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H