Executive brief
Koa is a popular Node.js web framework that handles HTTP requests and responses for web applications. The framework's back redirect feature contains a flaw that allows attackers to craft malicious referer headers to redirect users to attacker-controlled websites. An attacker could use this to execute phishing attacks or steal user credentials by making users visit fake login pages.
Technical details
The vulnerability is an open redirect (CWE-601) in Koa's response.redirect() implementation, specifically in the back redirect logic in response.js line 326. The code checks if a referrer URL starts with "/" to treat it as a safe relative path, but protocol-relative URLs like "//evil.com" also start with "/" and are passed through unchecked. When a browser receives "Location: //evil.com", it interprets this as a redirect to https://evil.com, bypassing the intended same-origin protection. An attacker can craft a request with "Referer: //attacker.com" to trigger a cross-origin redirect. User interaction is required (the user must click a crafted link). Patches are available in Koa 2.16.3 and 3.0.3.
Affected products
- Koa Koa 2.16.2 through 2.16.2; 3.0.1 through 3.0.2
Timeline
- 2025-10-21: disclosed: Advisory published
- 2025-10-21: patched: Patches released in versions 2.16.3 and 3.0.3