CVE-2025-25200

CVE-2025-25200 describes a Denial-of-Service vulnerability in Koa, an expressive middleware for Node.js, affecting versions prior to 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3. The vulnerability stems from Koa's use of an inefficient regular expression to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers, which can be exploited to cause a denial of service. With a CVSS score of 7.5 (HIGH), this vulnerability is remotely exploitable with low attack complexity, requiring no user interaction or privileges, and its impact is solely on availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.