Skip to content
fr Sign in
5.0 Medium

CVE-2025-32379 Koa is expressive middleware for Node.js using ES2017 async functions

Description

Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.

Affected products and versions

Product Affected versions Fixed in
koa 3.0 3.0.0-alpha.0 → < 3.0.0-alpha.5 3.0.0-alpha.5
koa 2.16 earliest → < 2.16.1 2.16.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of koa

The 5 CVEs of koa →
CVE-2026-27959 Koa is middleware for Node.js using ES2017 async functions 7.5 High CVE-2025-62595 Koa is expressive middleware for Node.js using ES2017 async functions 4.3 Medium CVE-2025-8129 A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0 5.1 Medium CVE-2025-25200 Koa is expressive middleware for Node.js using ES2017 async functions 9.2 Critical
Track this CVE