# CVE-2025-32379: Koajs Cross-Site Scripting in ctx.redirect()

Source: https://junglewise.ai/threats/cve-2025-32379-koajs-cross-site-scripting-in-ctx-redirect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-32379 · Severity: low · CVSS 3.1 · Published 2025-04-09

Koajs is a popular Node.js web application framework used to build web services. A cross-site scripting (XSS) vulnerability in the ctx.redirect() function allows attackers to inject malicious JavaScript code that executes in users' browsers, potentially stealing session cookies, redirecting users to phishing sites, or making unauthorized requests on behalf of authenticated users.

Technologies: [Koajs Koa](https://junglewise.ai/threats/technologies/koa). Vendors: [Koajs](https://junglewise.ai/threats/vendors/koajs).

## Quick answers

**Is CVE-2025-32379 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-32379 being exploited in the wild.

**How severe is CVE-2025-32379?** Low severity, with a CVSS score of 3.1, published 9 April 2025.

**Which products and versions are affected?** Koajs Koa < 2.16.1 and 3.0.0-alpha.1 to < 3.0.0-alpha.5.

**Is there a fix for CVE-2025-32379?** A patch was published on 2025-04-09: Patches released in 2.16.1 and 3.0.0-alpha.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-32379 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-32379?** Check whether you run Koajs Koa at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting (CWE-79) flaw in Koa versions prior to 2.16.1 and 3.0.0-alpha.5. The ctx.redirect() function fails to properly sanitize untrusted user input even when developers attempt to sanitize it, allowing XSS payload injection. The attack vector is network-based and requires user interaction (the user must follow a malicious link or visit an affected page). An attacker can inject JavaScript that executes in the victim's browser context, enabling cookie theft, phishing redirects, or unauthorized API requests. The vulnerability is patched in Koa 2.16.1 and 3.0.0-alpha.5.

## Affected products

- Koajs koa < 2.16.1 and 3.0.0-alpha.1 to < 3.0.0-alpha.5

## Identifiers

- CVE-2025-32379
- GHSA-x2rg-q646-7m2v

## Timeline

- 2025-04-09: disclosed: Advisory published (GHSA-x2rg-q646-7m2v)
- 2025-04-09: patched: Patches released in 2.16.1 and 3.0.0-alpha.5

## References

- [https://github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v](https://github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v)

## Related threats

- [Koa open redirect via Referrer header](https://junglewise.ai/threats/koa-open-redirect-via-referrer-header-0a2cc61b)
- [Koa inefficient regular expression in header parsing](https://junglewise.ai/threats/cve-2025-25200-koa-inefficient-regular-expression-in-header-parsing)