CVE-2023-49803

CVE-2023-49803 affects the @koa/cors npm package, used for Cross-Origin Resource Sharing (CORS) in Node.js Koa applications prior to version 5.0.0. The vulnerability stems from the middleware's default behavior of reflecting the request's origin in the Access-Control-Allow-Origin header when no allowed origins are explicitly configured, effectively disabling the browser's Same Origin Policy. This is a high-severity vulnerability (CVSS 7.5) with a network attack vector and low complexity, potentially leading to high integrity impact by allowing unauthorized cross-origin requests. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.