CVE-2025-62595 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
Attackers can exploit a flaw in Koa's back redirect logic to force users to malicious external sites via manipulated Referer headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-62595?
CVE-2025-62595 is a medium-severity vulnerability in koajs koa, published on 21 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications. This issue has been patched in version 3.0.3.
Weakness: CWE-601
Which versions are affected by CVE-2025-62595?
4 open source packages ship an affected version, including koa. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
koa npm | From 2.16.2 | 2.16.3 |
koa npm | From 2.16.2 | 2.16.3 |
koa npm | From 3.0.1 | 3.0.3 |
koa npm | From 3.0.1 | 3.0.3 |
Products include Koajs Koa.
How do I fix CVE-2025-62595?
Upgrade koa to a fixed version for your release line: 2.16.3 or 3.0.3.
Is CVE-2025-62595 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-62595 exists.
Other vulnerabilities in koajs koa
Sources
Also known as GHSA-g8mr-fgfg-5qpc.