CVE-2026-27959

Description: Koa's ctx.hostname getter parses the HTTP Host header by splitting on the first colon, without validating that the value conforms to RFC 3986 authority syntax. RFC 3986 permits an optional userinfo component before an @ delimiter, so a crafted header such as evil.com:fake@legitimate.com:3000 causes ctx.hostname to return the attacker-controlled evil.com rather than the real host. Affects versions before 2.16.4 and, on the 3.x line, before 3.1.2.

Impact: Host Header Injection. Applications that build security-sensitive URLs from ctx.hostname (password reset links, email verification URLs) or that make routing decisions on it can be redirected to an attacker-chosen host, enabling password reset poisoning.