# What changed in koa

> 29 changes in koa 3 from its official release notes, upgrade guides and advisories: 8 breaking, 4 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-23. HTML: https://unstale.sh/npm/koa/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## koa 3

### Breaking changes

- Adds `.back(fallback_url)` as the replacement for `.redirect('back')`. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- The obsolete middleware is removed. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Generators are no longer supported, and Koa no longer asserts if they are used. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- The minimum supported Node.js version is v18. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- The special `.redirect('back')` behavior is removed; use `.back(fallback_url)` instead. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Redirect values are no longer rendered in the anchor reference. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Displays the Origin header when it exists rather than the current hostname, aligning with CORS usage. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Requires the format `ctx.throw(status, error, properties)`. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)

### Security

- Fixes Host Header Injection via ctx.hostname. (2.16.4, 3.1.2) — [release notes](https://github.com/koajs/koa/releases/tag/v3.1.2), [security advisory](https://github.com/advisories/GHSA-7GCC-R8M5-44QM), [release notes](https://github.com/koajs/koa/releases/tag/v2.16.4)
- Normalizes the referer before redirecting. (2.16.3, 3.0.3) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.3), [release notes](https://github.com/koajs/koa/releases/tag/v2.16.3), [security advisory](https://github.com/advisories/GHSA-G8MR-FGFG-5QPC)
- Fixes response.attachment behavior that leads to Content-Type sniffing. (3.0.2) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.2)
- Avoids regular-expression denial of service on the host and protocol getters. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)

### New APIs and options

- Provides access to the current context from the app using `app.currentContext`. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Adds support for custom streams. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Adds support for WHATWG response bodies. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)

### Behavior and default changes

- Defer AsyncLocalStorage creation to support v8 startup snapshots. (3.2.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.2.0)

### Fixes and other changes

- Fixes request.length overflowing when Content-Length exceeds 2GB. (3.2.1) — [release notes](https://github.com/koajs/koa/releases/tag/v3.2.1)
- Only destroy the original value when the new value is not a stream. (3.1.1) — [release notes](https://github.com/koajs/koa/releases/tag/v3.1.1)
- Fixes a memory leak relating to issue-1834. (3.1.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.1.0)
- Adds stream cleanup. (3.1.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.1.0)
- Fixes body null checks. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Assigning a JSON body no longer overwrites the type when the type is already JSON. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- When the type is JSON and the body is null, sets the body to 'null'. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Sets content-length to 0 when the body is explicitly set to null. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Does not send Content-Length when Transfer-Encoding is defined. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Fixes access to currentContext in the error handler. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Fixes passing ctx in the error handler. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Fixes reformatting of redirect URLs. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)
- Handles responses when the socket is no longer writable. (3.0.0) — [release notes](https://github.com/koajs/koa/releases/tag/v3.0.0)