Koa's ctx.hostname function parsed the Host header without RFC 3986 validation, taking the substring before the first colon. A header that contains an @ symbol is treated as a valid hostname and returned exactly as the attacker supplied, e.g. an incoming header of "evil@example.com" results in ctx.hostname returning "evil.com". Applications that use ctx.hostname to construct URLs for password reset links, email verification, or routing are therefore able to inject an attacker-controlled hostname into user-facing links. This allows attackers to create convincing phishing URLs, redirect users, or potentially facilitate credential‑stealing or session‑fixation attacks when the forged hostname is embedded in authentication or password‑reset links.

Koajs Koa, a Node.js middleware library. The vulnerability is present in all releases prior to version 3.1.2 and 2.16.4. Users of these earlier releases are affected regardless of the operating system or hosting environment.

The issue has a CVSS score of 7.5 (high) and an EPSS score of less than 1%, indicating the likelihood of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it from any location that can send HTTP requests to the vulnerable service, for example by crafting a malicious request that includes a Host header with an @ symbol. No privileged access or additional compromise is required beyond the ability to send a request to the application.