CVE-2025-62595

MediumCVSS 4.3

Published: 21/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

20th percentile - higher than 20% of all known CVEs

Summary

Koa, a framework for Node.js, in versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, has a bypass to CVE-2025-8129 affecting its back redirect functionality. An attacker can manipulate the Referer header to force a user's browser to navigate to an external, potentially malicious website.

Risk Assessment

Users of applications based on Koa may be exposed to phishing or social engineering attacks through redirects to malicious sites.

Recommendation

Update Koa to version 3.0.3 or later, which includes a fix for this vulnerability.

Other vulnerabilities in Koa

CVE-2026-27959High
A vulnerability in the Koa library for Node.js involves improper parsing of the Host header by the `ctx.hostname` API. An attacker can send a crafted Host header containing a `@` symbol, causing the API to return an attacker-controlled value, e.g., `evil[.]com`. The issue affects versions prior to 3.1.2 and 2.16.4.

Original NVD description (English source)

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications. This issue has been patched in version 3.0.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS