koa

koa breaking-changes badge

koa (latest known version: 3.2.1) has 2 known breaking changes on record, each backed by a source URL.

Actively maintainedLatest known version: 3.2.1npm ↗

Security advisories

GHSA-593f-38f6-jp5mCRITICAL>=2.0.0 <2.15.4 || >=3.0.0-alpha.0 <3.0.0-alpha.3 || >=1.0.0 <1.7.1 || <0.21.2

Inefficient Regular Expression Complexity in koa

source ↗

GHSA-7gcc-r8m5-44qmHIGH>=3.0.0 <3.1.2 || <2.16.4

Koa has Host Header Injection via ctx.hostname

source ↗

GHSA-g8mr-fgfg-5qpcMODERATE>=3.0.1 <3.0.3 || >=2.16.2 <2.16.3

Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic

source ↗

GHSA-jgmv-j7ww-jx2xLOW>=2.0.0 <2.16.2 || >=3.0.0-alpha.0 <3.0.1

Koa Open Redirect via Referrer Header (User-Controlled)

source ↗

GHSA-x2rg-q646-7m2vMODERATE<2.16.1 || >=3.0.0-alpha.1 <3.0.0-alpha.5

Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function

source ↗

Recent changes

v3.0.0-alpha.4Breaking

Breaking Changes: - .req.origin now represents `req.headers.origin` - `.body=<json>` does not overwrite `.type=` if the type is already json - Removed special `ENOENT` error support - please check your file handling functions - .res.set - do not coerce headers to be strings

source ↗

v3.0.0Breaking

Version 3.0.0 is a semver-major release over 2.16.4, but no breaking change was detected in the release notes text - flagged for manual review.

source ↗

Check what changed for koa since your installed version, live.

Open the playground →