Koa CVE-2025-62595

The affected application must call Koa's ctx.back() helper (the back-redirect feature in lib/response.js), which reads the Referer/referrer header to decide where to redirect. The specific exploitable condition: a protocol-relative URL (e.g. '//evil.com' or '//evil.com/login/' with trailing double-slash) is wrongly matched by the startsWith('/') check and treated as a safe relative path, so it is emitted verbatim in the Location header. Limiting factors: exploitation requires user interaction (UI:R) - the victim must follow the attacker's link/flow; it is ineffective against Koa apps that do not use ctx.back(); and impact is confined to redirecting the browser (phishing/social engineering), not server compromise. No authentication is required (PR:N).

This is a genuinely moderate (not critical) issue, and the multiple signals agree rather than conflict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) describes a classic CWE-601 open redirect: network-reachable, low complexity, no authentication, but requiring user interaction, with only limited confidentiality/integrity impact and a scope change to the victim's browser. The EPSS score is low (0.29%, 20th percentile), consistent with an open redirect that aids phishing but does not yield direct code execution or data compromise. This CVE is NOT on CISA KEV, so there is no evidence of active exploitation; however, publicly available exploit code exists (the GHSA advisory includes a working curl PoC and the patch commit tests). The key real-world limiter not captured by the high-level CVSS score is that exploitation depends entirely on the target application actually invoking Koa's ctx.back() redirect helper - many Koa apps never use it, which materially shrinks the exploitable population below what AV:N/PR:N alone implies. Net: a real but low-urgency hygiene fix (update the dependency), not an emergency, and clearly not a 'high CVSS inflated beyond reality' case since 6.1 already reflects the limited impact.

An attacker crafts a link to a vulnerable Koa application and induces a victim to click it while setting (or relying on) a protocol-relative Referer value such as '//evil.com'. When the application calls ctx.back(), the framework emits 'Location: //evil.com', which browsers interpret as an absolute redirect to https://evil.com, landing the victim on an attacker-controlled phishing page. A public proof-of-concept exists in the GHSA advisory (curl -i -H "Referer: //haymiz.dev"), and because the flaw needs only user interaction with no authentication (UI:R, PR:N), it is practical to weaponize for social-engineering campaigns.