AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

CWE-20

https://access.redhat.com/errata/RHSA-2026:10184

https://access.redhat.com/errata/RHSA-2026:7249

https://access.redhat.com/security/cve/CVE-2026-27959

https://bugzilla.redhat.com/show_bug.cgi?id=2442928

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27959.json

[{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat Developer Hub","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhdh:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Self-service automation portal 2","defaultStatus":"affected","cpes":["cpe:/a:redhat:ansible_portal:2"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift_devspaces:3"]}]

{"timestamp":"2026-02-26T19:31:17.215940Z","id":"CVE-2026-27959","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"koajs","product":"koa","versions":[{"version":">= 3.0.0, < 3.1.2","status":"affected"},{"version":"< 2.16.4","status":"affected"}]}]

OR
          *cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* versions up to (excluding) 2.16.14
          *cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* versions from (including) 3.0.0 up to (excluding) 3.1.2

OR
          *cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* versions from (including) 3.0.0 up to (excluding) 3.1.2
          *cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* versions up to (excluding) 2.16.4

NVD-CWE-noinfo

OR
          *cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* versions up to (excluding) 2.16.14
          *cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* versions from (including) 3.0.0 up to (excluding) 3.1.2

GitHub, Inc.: https://github.com/koajs/koa/commit/55ab9bab044ead4e82c70a30a4f9dc0fc9c1b6df Types: Patch

GitHub, Inc.: https://github.com/koajs/koa/commit/b76ddc01fdb703e51652b0fd131d16394cadcfeb Types: Patch

GitHub, Inc.: https://github.com/koajs/koa/security/advisories/GHSA-7gcc-r8m5-44qm Types: Exploit, Vendor Advisory

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conforms to RFC 3986 hostname syntax. When a malformed Host header containing a `@` symbol is received, `ctx.hostname` returns `evil[.]com` - an attacker-controlled value. Applications using `ctx.hostname` for URL generation, password reset links, email verification URLs, or routing decisions are vulnerable to Host header injection attacks. Versions 3.1.2 and 2.16.4 fix the issue.

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-20

https://github.com/koajs/koa/commit/55ab9bab044ead4e82c70a30a4f9dc0fc9c1b6df

https://github.com/koajs/koa/commit/b76ddc01fdb703e51652b0fd131d16394cadcfeb

https://github.com/koajs/koa/security/advisories/GHSA-7gcc-r8m5-44qm