npm / koa

koa

What changed in koa 3, from its official release notes, upgrade guides and advisories. Also covers @types/koa. Sources checked 2026-10-23.

8 breaking4 security3 new APIs and options1 behavior and defaults13 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

koa 329 changes

Adds .back(fallback_url) as the replacement for .redirect('back').
3.0.0release notes
The obsolete middleware is removed.
3.0.0release notes
Generators are no longer supported, and Koa no longer asserts if they are used.
3.0.0release notes
The minimum supported Node.js version is v18.
3.0.0release notes
The special .redirect('back') behavior is removed; use .back(fallback_url) instead.
3.0.0release notes
Redirect values are no longer rendered in the anchor reference.
3.0.0release notes
Displays the Origin header when it exists rather than the current hostname, aligning with CORS usage.
3.0.0release notes
Requires the format ctx.throw(status, error, properties).
3.0.0release notes

Fixes Host Header Injection via ctx.hostname.
2.16.4, 3.1.2release notes security advisory release notes
Normalizes the referer before redirecting.
2.16.3, 3.0.3release notes release notes security advisory
Fixes response.attachment behavior that leads to Content-Type sniffing.
3.0.2release notes
Avoids regular-expression denial of service on the host and protocol getters.
3.0.0release notes

Provides access to the current context from the app using app.currentContext.
3.0.0release notes
Adds support for custom streams.
3.0.0release notes
Adds support for WHATWG response bodies.
3.0.0release notes

Defer AsyncLocalStorage creation to support v8 startup snapshots.
3.2.0release notes

Fixes request.length overflowing when Content-Length exceeds 2GB.
3.2.1release notes
Only destroy the original value when the new value is not a stream.
3.1.1release notes
Fixes a memory leak relating to issue-1834.
3.1.0release notes
Adds stream cleanup.
3.1.0release notes
Fixes body null checks.
3.0.0release notes
Assigning a JSON body no longer overwrites the type when the type is already JSON.
3.0.0release notes
When the type is JSON and the body is null, sets the body to 'null'.
3.0.0release notes
Sets content-length to 0 when the body is explicitly set to null.
3.0.0release notes
Does not send Content-Length when Transfer-Encoding is defined.
3.0.0release notes
Fixes access to currentContext in the error handler.
3.0.0release notes
Fixes passing ctx in the error handler.
3.0.0release notes
Fixes reformatting of redirect URLs.
3.0.0release notes
Handles responses when the socket is no longer writable.
3.0.0release notes