CVE-2025-32379: Koa Package Vulnerable to Cross-Site Scripting (XSS) via ctx.redirect() Function
Summary
CVE-2025-32379: Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function. Affects koa across 2 version ranges.
< 2.16.1
>= 3.0.0-alpha.1, < 3.0.0-alpha.5
Fixed in 2.16.1 or 3.0.0-alpha.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Koa is a popular web framework for Node.js, designed to be lightweight and expressive. It allows developers to build web applications and APIs with a focus on middleware and asynchronous programming. Koa's ctx.redirect() function is used to redirect users to different URLs. However, earlier versions of Koa (specifically versions below 2.16.1 and 3.0.0-alpha.5) are susceptible to a Cross-Site Scripting (XSS) vulnerability when untrusted user input is passed to this function, potentially leading to security breaches.
Vulnerability Detail
The vulnerability arises from the improper handling of user input in the ctx.redirect() function. Even after sanitization, if untrusted input is used, it can execute malicious JavaScript code in the context of the user's browser. This can lead to serious consequences, such as redirecting users to phishing sites, making unauthorized requests using the user's cookies, or stealing sensitive information like cookies. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Latest published version: 3.2.1 as of 22 Oct 2026
npm install koa@3.2.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.16.12.16.1npm install koa@2.16.1 -
>= 3.0.0-alpha.1, < 3.0.0-alpha.53.0.0-alpha.5npm install koa@3.0.0-alpha.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, avoid passing untrusted user input directly to the ctx.redirect() function. Instead, validate and sanitize the input thoroughly before using it. For example, you can implement a whitelist of allowed URLs and check the user input against this list before redirecting.
Conclusion
The Koa package has a vulnerability (CVE-2025-32379) that can lead to Cross-Site Scripting (XSS) attacks through the ctx.redirect() function. It is crucial to update to the patched versions to protect against potential security risks. Implementing proper input validation and using tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for koa →
FAQ
The CVSS score of this vulnerability is 5.0, indicating a moderate severity level.
Koa versions below 2.16.1 and 3.0.0-alpha.5 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected. You can also use the Vulert playground at Vulert Scanner to check without signing up.
The potential impacts include redirecting users to phishing sites, making unauthorized requests based on user cookies, and stealing sensitive information such as cookies.
If immediate updates are not possible, implement input validation and sanitization as a temporary workaround to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for koa.
