Vulnerability · Published Jul 25, 2025 · Assigned by VulDB

CVE-2025-8129KoaJS Koa HTTP Header response.js back redirect

Low 3.5

In plain English

A low-severity open redirect in Koa from KoaJS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 78.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	koa	2.16.2	GHSA-jgmv-j7ww-jx2x
npm	koa	3.0.1	GHSA-jgmv-j7ww-jx2x

Affected products (as reported)

Vendor	Product	Versions
KoaJS	Koa	3.0

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-317514 | KoaJS Koa HTTP Header response.js back redirect vdb-entry, technical-description
VDB-317514 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #619741 | KoaJS Koa <=3.0.0 commit cb22d8dc Open Redirect third-party-advisory
https://github.com/koajs/koa/issues/1892 issue-tracking
https://github.com/koajs/koa/issues/1892#issue-3213028583 exploit, issue-tracking