Koa · Koa · CVE-2025-32379
Name of the Vulnerable Software and Affected Versions:
Koa versions prior to 2.16.1
Koa versions prior to 3.0.0-alpha.5
Description:
The issue arises when passing untrusted user input to `ctx.redirect()`, which can execute JavaScript code on the user's device, even after sanitizing the input.
Recommendations:
For versions prior to 2.16.1, update to version 2.16.1 or later.
For versions prior to 3.0.0-alpha.5, update to version 3.0.0-alpha.5 or later.
As a temporary workaround, consider avoiding the use of `ctx.redirect()` with untrusted user input until a patch is applied.