p PatchFirst

CVE-2025-32379

CVE-2025-32379 · XSS at ctx.redirect() function in Koajs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.

CVSS 5.0 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • koa

    Versions
    • >= 3.0.0-alpha.0, < 3.0.0-alpha.5: Affected
    • < 2.16.1: Affected

    No fix published

  • koa npm

    Affected ranges
    • SEMVER: < 2.16.1

    Update to 2.16.1

  • koa npm

    Affected ranges
    • SEMVER: ≥ 3.0.0-alpha.1, < 3.0.0-alpha.5

    Update to 3.0.0-alpha.5

Original sources

Check your server →