Read the docs
TI-2025-38810 Aliases CVE-2025-62595GHSA-g8mr-fgfg-5qpc

Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic

Priority MEDIUM 60CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications. This issue has been patched in version 3.0.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00293 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed koa (koajs): 2.16.3, 3.0.3koa (npm): 3.0.3, 2.16.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
koajskoa2.16.2 to before 2.16.3; 3.0.1 to before 3.0.32.16.3, 3.0.3Patch availableCNA
—koa (npm)3.0.1 to before 3.0.33.0.3Patch availableGHSA-g8mr-fgfg-5qpc
—koa (npm)2.16.2 to before 2.16.32.16.3Patch availableGHSA-g8mr-fgfg-5qpc
  • koa Vendorkoajs Affected 2.16.2 to before 2.16.3; 3.0.1 to before 3.0.3 Fixed in 2.16.3, 3.0.3 Patch available CNA
  • koa (npm) Vendor— Affected 3.0.1 to before 3.0.3 Fixed in 3.0.3 Patch available GHSA-g8mr-fgfg-5qpc
  • koa (npm) Vendor— Affected 2.16.2 to before 2.16.3 Fixed in 2.16.3 Patch available GHSA-g8mr-fgfg-5qpc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:*3.0.1 to before 3.0.3Vulnerablekoajs
cpe:2.3:a:koajs:koa:2.16.2:*:*:*:*:node.js:*:*2.16.2Vulnerablekoajs
  • cpe:2.3:a:koajs:koa:*:*:*:*:*:node.js:*:* Versions 3.0.1 to before 3.0.3 Vulnerable ·koajs
  • cpe:2.3:a:koajs:koa:2.16.2:*:*:*:*:node.js:*:* Versions 2.16.2 Vulnerable ·koajs

Remediation

  • Fix · CNA koa (koajs) Fixed in 2.16.3, 3.0.3
  • Fix · GHSA-g8mr-fgfg-5qpc koa (npm) Fixed in 3.0.3 Advisory →
  • Fix · GHSA-g8mr-fgfg-5qpc koa (npm) Fixed in 2.16.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat Developer Hub 1
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62595
  2. 2026-10-03 Alias added: GHSA-g8mr-fgfg-5qpc
  3. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-22302 Koa has Host Header Injection via `ctx.hostname` CVSS 3.1HIGH 7.5
  • TI-2025-07436 KoaJS Koa HTTP Header response.js back redirect CVSS 4.0MEDIUM 5.1
  • TI-2025-18869 Koa has Inefficient Regular Expression Complexity CVSS 4.0CRITICAL 9.2
  • TI-2025-23458 XSS at ctx.redirect() function in Koajs CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences