CVE-2025-32379 XSS at ctx.redirect() function in Koajs

What is CVE-2025-32379?

CVE-2025-32379 is a medium-severity cross-site scripting vulnerability in koajs koa, published on 9 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.

Weakness: CWE-79

Which versions are affected by CVE-2025-32379?

4 open source packages ship an affected version, including koa. It affects 1 product.

Products include Koajs Koa.

How do I fix CVE-2025-32379?

Upgrade koa to a fixed version for your release line: 2.16.1 or 3.0.0-alpha.5.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-32379 being exploited?

There is no known exploitation of CVE-2025-32379 in the wild and no public exploit code.

Other vulnerabilities in koajs koa

• CVE-2025-25200 Koa has Inefficient Regular Expression Complexity Critical 9.2
• CVE-2026-27959 Koa has Host Header Injection via `ctx.hostname` High 7.5
• CVE-2025-8129 KoaJS Koa HTTP Header response.js back redirect Medium 5.1
• CVE-2025-62595 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2026-1774830253, GHSA-x2rg-q646-7m2v, ROOT-APP-NPM-CVE-2025-32379.