p PatchFirst

CVE-2025-62595

CVE-2025-62595 · Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications. This issue has been patched in version 3.0.3.

CVSS 4.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • koa

    Versions
    • >= 2.16.2, < 2.16.3: Affected
    • >= 3.0.1, < 3.0.3: Affected

    No fix published

  • koa npm

    Affected ranges
    • SEMVER: ≥ 3.0.1, < 3.0.3

    Update to 3.0.3

  • koa npm

    Affected ranges
    • SEMVER: ≥ 2.16.2, < 2.16.3

    Update to 2.16.3

Original sources

Check your server →