CVE-2025-32379
XSS at ctx.redirect() function in Koajs
Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
XSS at ctx.redirect() function in Koajs
Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.
- Record
CVE-2025-32379- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-10545
Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.
- Record
EUVD-2025-10545- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x2rg-q646-7m2v
Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function
Summary
In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.
Patches
This issue is patched in 2.16.1 and 3.0.0-alpha.5.
PoC
Coming soon...
Impact
- Redirect user to another phishing site
- Make request to another endpoint of the application based on user's cookie
- Steal user's cookie
- Record
GHSA-x2rg-q646-7m2v- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.
- Record
CVE-2025-32379- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
XSS at ctx.redirect() function in Koajs
Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.
- Record
CVE-2025-32379- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-x2rg-q646-7m2v
Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function
Summary
In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.
Patches
This issue is patched in 2.16.1 and 3.0.0-alpha.5.
PoC
Coming soon...
Impact
- Redirect user to another phishing site
- Make request to another endpoint of the application based on user's cookie
- Steal user's cookie
- Record
GHSA-x2rg-q646-7m2v- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1774830253 No score
TuxCare security update for koa (1 CVE)
TuxCare rebuilt koa to address 1 CVE. Fixed in 1.7.1-tuxcare.1.
- Record
CLSA-2026-1774830253- Updated
- 2026-11-02
OSVCLSA-2026-1787657292 No score
TuxCare security update for koa (4 CVEs)
TuxCare rebuilt koa to address 4 CVEs. Fixed in 2.15.3-tuxcare.1.
- Record
CLSA-2026-1787657292- Updated
- 2026-11-02
OSVCLSA-2026-1792779347 No score
TuxCare security update for koa (4 CVEs)
TuxCare rebuilt koa to address 4 CVEs. Fixed in 2.15.4-tuxcare.1.
- Record
CLSA-2026-1792779347- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2025-32379 No score
CVE-2025-32379 in @rootio/koa - Patched by Root
Root has patched CVE-2025-32379 in the @rootio/koa package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2025-32379- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
koanpm |
before 2.16.1 | 2.16.1 |
koanpm |
3.0.0-alpha.1 up to 3.0.0-alpha.5 | 3.0.0-alpha.5 |
koaTuxCare:npm |
1.7.1-tuxcare.0 up to 1.7.1-tuxcare.1, plus listed versions 1.7.1 |
1.7.1-tuxcare.1 |
koaTuxCare:npm From an advisory covering 4 CVEs |
2.15.3-tuxcare.0 up to 2.15.3-tuxcare.1, plus listed versions 2.15.3 |
2.15.3-tuxcare.1 |
koaTuxCare:npm From an advisory covering 4 CVEs |
2.15.4-tuxcare.0 up to 2.15.4-tuxcare.1, plus listed versions 2.15.4 |
2.15.4-tuxcare.1 |
@rootio/koaRoot:npm |
before 2.15.4-root.io.4 | 2.15.4-root.io.4 |
koaRoot:npm |
before 2.15.4-aikido.4 | 2.15.4-aikido.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-32379 is a medium vulnerability (CVSS 5.0) in Koajs Koa, published April 9, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in koa 2.16.1.
References
github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v
nvd.nist.gov/vuln/detail/CVE-2025-32379