medium5.0
CVE-2025-32379
Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function
Impact
### Summary In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. ### Patches This issue is patched in 2.16.1 and 3.0.0-alpha.5. ### PoC Coming soon... ### Impact 1. Redirect user to another phishing site 2. Make request to another endpoint of the application based on user's cookie 3. Steal user's cookie
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | koa | < 2.16.1 | 2.16.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Koajs | Koa | before 2.16.1 Version 3.0.0 |