Version Details and Security Vulnerabilities

📦

koa

1.5.0

Comparision Betweeen 1.5.0 and 1.4.1

Identify the differences between the current version of the package and the previous one.

Version

Dependencies

Dev Dependencies

Peer Dependencies

Distributed Files

N/A

Unpacked Size

N/A

Security Vulnerabilities

This site is an independent open-source project and is not affiliated with, endorsed by, or sponsored by npm, Inc. or GitHub, Inc. The name “npm” is a registered trademark of npm, Inc., used here solely to describe compatibility and reference publicly available npm package data.

Version Details and Security Vulnerabilities

📦

koa

1.5.0

Comparision Betweeen 1.5.0 and 1.4.1

Identify the differences between the current version of the package and the previous one.

Version

Dependencies

Dev Dependencies

Peer Dependencies

Distributed Files

N/A

Unpacked Size

N/A

Security Vulnerabilities

Security Details

Comprehensive list of direct or transitive vulnerabilities for version 1.5.0 of the package koa.

All Security Vulnerabilities

All the vulnerabilities related to the version 1.5.0 of the package

Summary:

Inefficient Regular Expression Complexity in koa

Details:

Summary

Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.

PoC

Coming soon.

Impact

This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.

Details about koa@1.5.0

Summary:

Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function

Details:

Summary

In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.

Patches

This issue is patched in 2.16.1 and 3.0.0-alpha.5.

PoC

Coming soon...

Impact

Redirect user to another phishing site
Make request to another endpoint of the application based on user's cookie
Steal user's cookie

Details about koa@1.5.0

Security Details

Comprehensive list of direct or transitive vulnerabilities for version 1.5.0 of the package koa.

All Security Vulnerabilities

All the vulnerabilities related to the version 1.5.0 of the package

Summary:

Inefficient Regular Expression Complexity in koa

Details:

Summary

Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.

PoC

Coming soon.

Impact

This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.

Details about koa@1.5.0

Summary:

Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function

Details:

Summary

In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.

Patches

This issue is patched in 2.16.1 and 3.0.0-alpha.5.

PoC

Coming soon...

Impact

Redirect user to another phishing site
Make request to another endpoint of the application based on user's cookie
Steal user's cookie

Details about koa@1.5.0

Version Details and Security Vulnerabilities

koa

Comparision Betweeen 1.5.0 and 1.4.1

Security Vulnerabilities

Version Details and Security Vulnerabilities

koa

Comparision Betweeen 1.5.0 and 1.4.1

Security Vulnerabilities

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

Summary

PoC

Impact

Summary

Patches

PoC

Impact

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

Summary

PoC

Impact

Summary

Patches

PoC

Impact

Version Details and Security Vulnerabilities

koa

Comparision Betweeen 1.5.0 and 1.4.1

Security Vulnerabilities

Version Details and Security Vulnerabilities

koa

Comparision Betweeen 1.5.0 and 1.4.1

Security Vulnerabilities

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

koa@1.5.0 GHSA-593f-38f6-jp5m 9.2

Summary

PoC

Impact

koa@1.5.0 GHSA-x2rg-q646-7m2v 5

Summary

Patches

PoC

Impact

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

koa@1.5.0 GHSA-593f-38f6-jp5m 9.2

Summary

PoC

Impact

koa@1.5.0 GHSA-x2rg-q646-7m2v 5

Summary

Patches

PoC

Impact