Regex Denial of Service in Koa Forwarded Header Parsing

This repository is a small proof-of-concept for CVE-2025-25200, described as a Regular Expression Denial of Service issue affecting Koa-related processing paths. The repo contains two functional code components: a Go exploit client in exploit/main.go and a Node.js/Koa vulnerable demo server in poc/index.js, plus documentation in README.md and DOCS/README.md and dependency metadata in poc/package.json and package-lock.json. The main exploit capability is denial of service via network input. The Go program sends an HTTP GET request to http://localhost:3000 and places a crafted payload in the X-Forwarded-For header. The payload is a long run of digits followed by a non-matching character, designed to trigger catastrophic backtracking against the regex /^(?:\d+)+$/. The exploit does not provide code execution, persistence, or shell access; it measures the target's response time and prints the HTTP status and elapsed duration, demonstrating service slowdown consistent with ReDoS. The PoC server in poc/index.js is a minimal Koa application that listens on port 3000, reads ctx.headers['x-forwarded-for'], and evaluates it with the vulnerable regex. It returns JSON containing the header value, whether it matched, and the processing time. This makes the repository self-contained for local reproduction: start the Node.js server, then run the Go client to observe the delay. Repository structure is straightforward: README.md explains the vulnerability, impact, and affected versions; DOCS/README.md provides execution steps; exploit/main.go is the attack client; poc/index.js is the vulnerable target; package.json and package-lock.json define the Node.js dependencies. Overall, this is a legitimate PoC exploit repository demonstrating a header-based network ReDoS condition against a locally hosted Koa application.