PT-2025-30726 · Koajs · Koajs

Zast.Ai · Published 2025-07-25 · Updated 2026-01-20 · CVE-2025-8129

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Koa versions up to 3.0.0

Description A problematic issue exists in KoaJS Koa. The back function within the HTTP Header Handler component, located in lib/response.js, is susceptible to open redirect attacks through manipulation of the Referrer argument. This issue can be exploited remotely. The exploit has been publicly disclosed.

Recommendations Versions prior to 3.0.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-8129

GHSA-JGMV-J7WW-JX2X

GHSA-MVW6-62QV-VMQF

Affected Products

Koajs

References · 19

• 🔥 https://github.com/koajs/koa/issues/1892 · Exploit
• 🔥 https://github.com/koajs/koa/issues/1892#issue-3213028583 · Exploit
• https://osv.dev/vulnerability/GHSA-mvw6-62qv-vmqf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-8129 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jgmv-j7ww-jx2x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8129 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-54420 · Security Note
• https://github.com/koajs/koa · Note
• https://github.com/koajs/koa/security/advisories/GHSA-jgmv-j7ww-jx2x · Note
• https://github.com/koajs/koa/commit/422c551c63d00f24e2bbbdf492f262a5935bb1f0 · Note
• https://vuldb.com/?id.317514 · Note
• https://t.me/cveNotify/149279 · Telegram Post
• https://t.me/CVEtracker/35417 · Telegram Post
• https://twitter.com/marcin_brz81183/status/1948659313565643073 · Twitter Post
• https://t.me/CVEtracker/28679 · Telegram Post