KoaJS Koa
CVE-2025-8129
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1Blast Radius
ecosystem impact- 34 npm packages depend on koa (31 direct, 3 indirect)
Ecosystem-wide dependent count for version 2.0.0.
DescriptionCVE.org
A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Open redirect vulnerability in KoaJS Koa up to version 3.0.0 allows authenticated remote attackers to manipulate the Referrer HTTP header via the back() function in lib/response.js, enabling redirect to arbitrary external URLs with user interaction. The vulnerability has publicly available exploit code and affects the HTTP Header Handler component; EPSS exploitation probability is very low at 0.08% despite public POC availability, suggesting this is primarily a client-side social engineering vector rather than a widely exploitable server-side flaw.
Technical ContextAI
KoaJS Koa is a lightweight Node.js web framework that provides request/response middleware abstractions. The vulnerability resides in the response.js module's back() function, which is intended to redirect users to their previous page via the HTTP Referer header (note: Koa implements the common misspelling 'Referrer'). CWE-601 (URL Redirection to Untrusted Site / Open Redirect) occurs when user-controlled input-in this case, a maliciously crafted Referrer header-is used to construct a redirect target without validation. The back() function directly uses the Referrer header value without sanitizing it against malicious or external URLs, allowing an attacker to inject arbitrary redirect destinations. This is a classic open redirect vulnerability pattern where the application is manipulated into directing users away from the legitimate domain.
RemediationAI
Upgrade KoaJS Koa to a patched version released after 3.0.0. The upstream fix is available at https://github.com/koajs/koa/issues/1892, where the Koa maintainers have addressed this vulnerability by implementing validation of the Referrer header in the back() function to reject redirect targets pointing to external domains. If immediate patching is not possible, implement a compensating control by disabling or wrapping the back() function to validate that redirect destinations are same-origin only (e.g., ensuring the target URL hostname matches the request hostname), or by replacing the use of back() with explicit, hardcoded redirect destinations that cannot be influenced by user-supplied headers. Note that disabling back() entirely may require refactoring client-side 'go back' functionality to use browser history APIs instead.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today