# Koa CWE-407 Scan — CLEAN

**Scan date:** 2026-03-29

## Files scanned

- `lib/application.js` — middleware composition, request dispatch
- `lib/context.js` — context prototype, error handling
- `lib/request.js` — request parsing helpers
- `lib/response.js` — response helpers
- `lib/is-stream.js` — stream type check
- `lib/only.js` — object key filter
- `lib/search-params.js` — URL search param helpers

## Findings

- `lib/request.js:262` — `host.includes('@')` — single O(N) check on a hostname
  string, not inside any loop.
- `lib/request.js:355` — `methods.indexOf(this.method)` — checks membership in a
  6-element constant array `['GET','HEAD','PUT','DELETE','OPTIONS','TRACE']`.
  Called once per `idempotent` getter access. Fixed-size array (O(6) = O(1) in
  practice). No outer loop; a `Set` would be marginally faster but the array is
  too small to exhibit O(N²) behaviour in any realistic traffic pattern. Not a
  CWE-407 defect; noted as a minor allocation smell (new array per call).
- `lib/application.js` — middleware array is a plain push-only array; dispatch via
  `koa-compose` iterates it sequentially with no membership checks.
- `lib/context.js` — `res.getHeaderNames().forEach(...)` in `onerror` is bounded by
  the number of response headers (not nested).

## Conclusion

No CWE-407 defects found in Koa. The `methods.indexOf` at line 355 is a fixed
O(6) scan on a constant 6-element array — below any practical threshold and not
nested in a hot loop. All other membership-style calls are single-pass helpers.