5.1
Medium
CVE-2025-8129 A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0
Description
A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| koa | 3.0 | No fix stated |
References
- VDB-317514 | KoaJS Koa HTTP Header response.js back redirect vuldb.com
- VDB-317514 | CTI Indicators (IOB, IOC, TTP, IOA) vuldb.com
- Submit #619741 | KoaJS Koa <=3.0.0 commit cb22d8dc Open Redirect vuldb.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of koa
The 5 CVEs of koa →
CVE-2026-27959
Koa is middleware for Node.js using ES2017 async functions
7.5
High
CVE-2025-62595
Koa is expressive middleware for Node.js using ES2017 async functions
4.3
Medium
CVE-2025-32379
Koa is expressive middleware for Node.js using ES2017 async functions
5.0
Medium
CVE-2025-25200
Koa is expressive middleware for Node.js using ES2017 async functions
9.2
Critical