VYPR
← All advisories
Moderate severityNVD Advisory· Published Apr 9, 2025· Updated Apr 9, 2025

XSS at ctx.redirect() function in Koajs

CVE-2025-32379

Description

Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
koanpm
< 2.16.12.16.1
koanpm
>= 3.0.0-alpha.1, < 3.0.0-alpha.53.0.0-alpha.5

Affected products

1
  • Koajs/Koav5
    Range: >= 3.0.0-alpha.0, < 3.0.0-alpha.5

Patches

1
ff25eb4a7f23

fix: don't render redirect values in anchor ref

https://github.com/koajs/koajongleberryApr 6, 2025via ghsa
commit
2 files changed · +3 −3
  • lib/response.js+1 −1 modified
    @@ -309,7 +309,7 @@ module.exports = {
     if (this.ctx.accepts('html')) {
       url = escape(url)
       this.type = 'text/html; charset=utf-8'
-      this.body = `Redirecting to <a href="${url}">${url}</a>.`
+      this.body = `Redirecting to ${url}.`
       return
     }
  • __tests__/response/redirect.test.js+2 −2 modified
    @@ -80,7 +80,7 @@ describe('ctx.redirect(url)', () => {
       ctx.header.accept = 'text/html'
       ctx.redirect(url)
       assert.strictEqual(ctx.response.header['content-type'], 'text/html; charset=utf-8')
-      assert.strictEqual(ctx.body, `Redirecting to <a href="${url}">${url}</a>.`)
+      assert.strictEqual(ctx.body, `Redirecting to ${url}.`)
     })
 
     it('should escape the url', () => {
@@ -90,7 +90,7 @@ describe('ctx.redirect(url)', () => {
       ctx.redirect(url)
       url = escape(url)
       assert.strictEqual(ctx.response.header['content-type'], 'text/html; charset=utf-8')
-      assert.strictEqual(ctx.body, `Redirecting to <a href="${url}">${url}</a>.`)
+      assert.strictEqual(ctx.body, `Redirecting to ${url}.`)
     })
   })

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.