Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
koajs/koa
master @ 52d5e8f
24
Fixes
5
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Denial of Service: 10 prior fixes. Scrutinize any change in this area.
lib/response.js: most-fixed (12 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Regular Expression Denial of Service (ReDoS) during host, protocol, and IP parsing represents a high-severity risk that allows remote attackers to exhaust CPU resources via crafted headers. This is a recurring issue affecting header processing routines.
Open Redirect: The redirection logic inside `ctx.back()` and `this.redirect()` has historically suffered from trailing double-slash bypasses, case-insensitive protocol schemes, and unsafe relative path shortcuts that bypass same-origin validation.
Host Header Injection: Naive parsing of HTTP Host headers allowed attackers to inject arbitrary hosts using special characters like '@', bypassing routing and security policies that rely on `ctx.hostname`.