What’s Vulnerable › Vulnerabilities

CVE-2025-8129: KoaJS Koa HTTP Header response.js back redirect

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-25 · updated 2026-06-17
• Weakness: CWE-601

Description

A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

• koajs koa: from 2.0.0 before 2.16.2; 3.0.0, 3.0.0-alpha0, 3.0.0-alpha1, 3.0.0-alpha2, 3.0.0-alpha3, 3.0.0-alpha4 (+1) — fixed in 2.16.2

How to fix

Upgrade to a fixed version: koajs koa 2.16.2. Check the vendor advisory for mitigations.

References

• https://github.com/koajs/koa/issues/1892
• https://github.com/koajs/koa/issues/1892#issue-3213028583
• https://vuldb.com/?ctiid.317514
• https://vuldb.com/?id.317514
• https://vuldb.com/?submit.619741
• https://github.com/koajs/koa/issues/1892

Get alerted when CVE-2025-8129 or the next vulnerability affects your stack