koa 2.16.2 → 2.16.4

package/lib/request.js

@@ -257,7 +257,17 @@ module.exports = {
       if (!host) host = this.get('Host');
     }
     if (!host) return '';
-    return splitCommaSeparatedValues(host, 1)[0];
+    host = splitCommaSeparatedValues(host, 1)[0];
+    // Host header may contain userinfo (e.g., "user@host") which is invalid per RFC 7230.
+    // Use URL parser to correctly extract the host portion.
+    if (host.includes('@')) {
+      try {
+        host = new URL(`http://${host}`).host;
+      } catch (e) {
+        return '';
+      }
+    }
+    return host;
   },
 
   /**

package/lib/response.js

@@ -243,11 +243,6 @@ module.exports = {
   _getBackReferrer() {
     const referrer = this.ctx.get('Referrer');
     if (referrer) {
-      // referrer is a relative path
-      if (referrer.startsWith('/')) {
-        return referrer;
-      }
-
       // referrer is an absolute URL, check if it's the same origin
       const url = new URL(referrer, this.ctx.href);
       if (url.host === this.ctx.host) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "koa",
-  "version": "2.16.2",
+  "version": "2.16.4",
   "publishConfig": {
     "access": "public",
     "tag": "latest-2"