Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect LogicGHSA-g8mr-fgfg-5qpc
MEDIUMFix: koajs/koa@769fd75GHSA-g8mr-fgfg-5qpc is a medium-severity (CVSS 4.7) Open Redirect vulnerability in koa. A fix is available for koa — see the affected versions and patch details below.
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for GHSA-g8mr-fgfg-5qpc.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
koanpmDescription
Summary:
A bypass was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications.
This vulnerability affects the code referenced in GitHub Advisory GHSA-jgmv-j7ww-jx2x (which is tracked as CVE‑2025‑54420).
Details:
The patched code attempts to treat values that startWith('/') as safe relative paths and only perform origin checks for absolute URLs. However, protocol‑relative URLs (those beginning with //host) also start with '/' and therefore match the startsWith('/') branch. A protocol‑relative referrer such as //evil.com with trailing double-slash is treated by the implementation as a safe relative path, but browsers interpret Location: //evil.com as a redirect to https://evil.com (or http:// based on context).
This discrepancy allows an attacker to supply Referer: //evil.com and trigger an external redirect - bypassing the intended same‑origin protection.
Proof of concept (PoC):
Affected line of code: https://github.com/koajs/koa/blob/master/lib/response.js#L326 The problematic logic looks like:
<img width="567" height="509" alt="3" src="https://github.com/user-attachments/assets/33de440a-8945-4e5f-9e0a-2011a3999458" />Request with a protocol‑relative Referer: curl -i -H "Referer: //haymiz.dev" http://127.0.0.1:3000/test
<img width="2072" height="1005" alt="1" src="https://github.com/user-attachments/assets/55c48c79-559d-46aa-8b76-c1d2d3536c8b" />Vulnerable response will contain: HTTP/1.1 302 Found Location: //haymiz.dev
A browser receiving that Location header navigates to https://haymiz.dev (or http:// depending on context), resulting in an open redirect to an attacker‑controlled host:
<img width="454" height="239" alt="2" src="https://github.com/user-attachments/assets/852ae81a-9f63-49c1-9ce5-72cd96bcea68" />Recommendation / Patch:
- Do not treat //host as a safe relative path. Explicitly exclude protocol‑relative values from any relative‑path branch.
- Normalize the Referer by resolving it with a base (e.g., new URL(rawRef, ctx.href)), then compare resolved.origin (scheme+host+port) to ctx.origin (or ctx.host plus scheme/port) before allowing the redirect.
Impact:
An attacker who can cause a victim to visit a specially crafted link (or inject a request with a controlled Referer) can cause the victim to be redirected to an attacker‑controlled domain. This can be used for phishing, social engineering, or to bypass some protection rules that rely on same‑origin navigation.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | koa | ≥ 3.0.1&&< 3.0.3 | 3.0.3npm install koa@3.0.3 |
| 📦npm | koa | ≥ 2.16.2&&< 2.16.3 | 2.16.3npm install koa@2.16.3 |
Affected Products
koakoajsDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for koa, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update koa to 3.0.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g8mr-fgfg-5qpc is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
To exploit this flaw, an attacker needs to convince a user into visiting a malicious link, limiting the possibility of exploitation. However, this vulnerability still has a moderate severity due to the impact of redirect-based attacks.
Applications can use the following workarounds to mitigate this vulnerability: Do not treat //host as a safe relative path. Explicitly exclude protocol‑relative values from any relative‑path branch. Normalize the Referer by resolving it with a base (e.g., new URL(rawRef, ctx.href)), then compare resolved.origin (scheme+host+port) to ctx.origin (or ctx.host plus scheme/port) before allowing the redirect.Source: Red Hat security advisory for GHSA-g8mr-fgfg-5qpc (CC BY 4.0)
Frequently Asked Questions
Is GHSA-g8mr-fgfg-5qpc in your dependencies?
Find it across npm, including transitive dependencies.