CVE-2026-27959
HIGHKoa 3.0.0-3.1.1 and <2.16.14 - Host Header Injection via ctx.hostname
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2026-27959. PoCs published by XiaomingX, mlouazir.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2026-27959, demonstrating a hostname-based authentication bypass vulnerability in a Koa.js application. The exploit leverages a misconfiguration in the reverse proxy to trick the backend into accepting requests with a spoofed hostname.
Description
Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.
Exploits (2)
This repository contains a functional PoC for CVE-2026-27959, demonstrating a hostname-based authentication bypass vulnerability in a Koa.js application. The exploit leverages a misconfiguration in the reverse proxy to trick the backend into accepting requests with a spoofed hostname.
This repository contains a functional PoC for CVE-2026-27959, demonstrating a hostname spoofing vulnerability in a Koa.js application. The lab simulates a scenario where an attacker can bypass reverse proxy restrictions by manipulating the Host header to appear as 'evil.com' while originating from 'localhost'.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N