CVE-2025-8129
KoaJS Koa HTTP Header response.js back redirect
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jul 25, 2025
- Updated
- Jul 25, 2025
- Reserved
- Jul 24, 2025
Description
A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.5 Low | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 3.5 Low | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-601 Open Redirect
Affected Products
| Product | Versions |
|---|---|
KoaKoaJS |
|
References
- VDB-317514 | KoaJS Koa HTTP Header response.js back redirectvdb-entrytechnical-description
- VDB-317514 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #619741 | KoaJS Koa <=3.0.0 commit cb22d8dc Open Redirectthird-party-advisory
- https://github.com/koajs/koa/issues/1892issue-tracking
- https://github.com/koajs/koa/issues/1892#issue-3213028583exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.