Vulnerability · Published Oct 21, 2025 · Assigned by GitHub_M
CVE-2025-62595Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
Medium 4.3
In plain English
A medium-severity open redirect in koa from koajs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications. This issue has been patched in version 3.0.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | koa | 3.0.3 | GHSA-g8mr-fgfg-5qpc |
| npm | koa | 2.16.3 | GHSA-g8mr-fgfg-5qpc |
Affected products (as reported)
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://github.com/koajs/koa/security/advisories/GHSA-g8mr-fgfg-5qpc x_refsource_CONFIRM
- https://github.com/koajs/koa/commit/769fd75cc6b30d72493b370b5a3ae2332ca03c5b x_refsource_MISC