XSS at ctx.redirect() function in Koajs
Priority LOW 35CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00267 18th percentileScored 2026-11-07
Fix Partial koa (koajs): 3.0.0-alpha.5, 2.16.1koa (npm): 2.16.1, 3.0.0-alpha.5Red Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| koajs | koa | 3.0.0-alpha.0 to before 3.0.0-alpha.5; before 2.16.1 | 3.0.0-alpha.5, 2.16.1 | Patch available | CNA |
| — | koa (npm) | before 2.16.1 | 2.16.1 | Patch available | GHSA-x2rg-q646-7m2v |
| — | koa (npm) | 3.0.0-alpha.1 to before 3.0.0-alpha.5 | 3.0.0-alpha.5 | Patch available | GHSA-x2rg-q646-7m2v |
- koa Vendorkoajs Affected 3.0.0-alpha.0 to before 3.0.0-alpha.5; before 2.16.1 Fixed in 3.0.0-alpha.5, 2.16.1 Patch available CNA
- koa (npm) Vendor— Affected before 2.16.1 Fixed in 2.16.1 Patch available GHSA-x2rg-q646-7m2v
- koa (npm) Vendor— Affected 3.0.0-alpha.1 to before 3.0.0-alpha.5 Fixed in 3.0.0-alpha.5 Patch available GHSA-x2rg-q646-7m2v
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* | before 2.16.1 | Vulnerable | koajs |
| cpe:2.3:a:koajs:koa:3.0.0:alpha0:*:*:*:node.js:*:* | 3.0.0 alpha0 | Vulnerable | koajs |
| cpe:2.3:a:koajs:koa:3.0.0:alpha1:*:*:*:node.js:*:* | 3.0.0 alpha1 | Vulnerable | koajs |
| cpe:2.3:a:koajs:koa:3.0.0:alpha2:*:*:*:node.js:*:* | 3.0.0 alpha2 | Vulnerable | koajs |
| cpe:2.3:a:koajs:koa:3.0.0:alpha3:*:*:*:node.js:*:* | 3.0.0 alpha3 | Vulnerable | koajs |
| cpe:2.3:a:koajs:koa:3.0.0:alpha4:*:*:*:node.js:*:* | 3.0.0 alpha4 | Vulnerable | koajs |
- cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* Versions before 2.16.1 Vulnerable ·koajs
- cpe:2.3:a:koajs:koa:3.0.0:alpha0:*:*:*:node.js:*:* Versions 3.0.0 alpha0 Vulnerable ·koajs
- cpe:2.3:a:koajs:koa:3.0.0:alpha1:*:*:*:node.js:*:* Versions 3.0.0 alpha1 Vulnerable ·koajs
- cpe:2.3:a:koajs:koa:3.0.0:alpha2:*:*:*:node.js:*:* Versions 3.0.0 alpha2 Vulnerable ·koajs
- cpe:2.3:a:koajs:koa:3.0.0:alpha3:*:*:*:node.js:*:* Versions 3.0.0 alpha3 Vulnerable ·koajs
- cpe:2.3:a:koajs:koa:3.0.0:alpha4:*:*:*:node.js:*:* Versions 3.0.0 alpha4 Vulnerable ·koajs
Remediation
- Fix · CNA koa (koajs) Fixed in 3.0.0-alpha.5, 2.16.1
- Fix · GHSA-x2rg-q646-7m2v koa (npm) Fixed in 2.16.1 Advisory →
- Fix · GHSA-x2rg-q646-7m2v koa (npm) Fixed in 3.0.0-alpha.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-32379
- 2026-10-03 Alias added: GHSA-x2rg-q646-7m2v
- 2026-10-27 Affected versions changed · Red Hat
References
More koajs Koa vulnerabilities
- TI-2026-22302 Koa has Host Header Injection via `ctx.hostname` CVSS 3.1HIGH 7.5
- TI-2025-38810 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic CVSS 3.1MEDIUM 6.1
- TI-2025-07436 KoaJS Koa HTTP Header response.js back redirect CVSS 4.0MEDIUM 5.1
- TI-2025-18869 Koa has Inefficient Regular Expression Complexity CVSS 4.0CRITICAL 9.2
Sources
- CVE-2025-32379 · CVE Program
- CVE-2025-32379 · NVD
- FIRST EPSS
- GHSA-x2rg-q646-7m2v · GitHub Advisory Database · CC BY 4.0
- CVE-2025-32379 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences