Is CVE-2025-62595 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-62595 being exploited in the wild.

How severe is CVE-2025-62595?

Medium severity, with a CVSS score of 4.3, published 21 October 2025.

Which products and versions are affected?

koa (npm) SEMVER:introduced=3.0.1,fixed=3.0.3.

Is there a fix for CVE-2025-62595?

Yes. koa (npm): upgrade to 3.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-62595 attacked?

It is attacked over the network.

Am I affected by CVE-2025-62595?

Check whether you run koa (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-62595: Koa open redirect via protocol-relative URLs in back redirect

CVE-2025-62595 · Severity: medium · CVSS 4.3 · Published 2025-10-21

Koa is a popular Node.js web framework that handles HTTP requests and responses for web applications. The framework's back redirect feature contains a flaw that allows attackers to craft malicious referer headers to redirect users to attacker-controlled websites. An attacker could use this to execute phishing attacks or steal user credentials by making users visit fake login pages.

Technologies: koa (npm). Vendors: npm.

Quick answers

Is CVE-2025-62595 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-62595 being exploited in the wild.
How severe is CVE-2025-62595?: Medium severity, with a CVSS score of 4.3, published 21 October 2025.
Which products and versions are affected?: koa (npm) SEMVER:introduced=3.0.1,fixed=3.0.3.
Is there a fix for CVE-2025-62595?: Yes. koa (npm): upgrade to 3.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62595 attacked?: It is attacked over the network.
Am I affected by CVE-2025-62595?: Check whether you run koa (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

koa (npm): upgrade to 3.0.3 or later
```
npm install koa@3.0.3
```

Technical details

The vulnerability is an open redirect (CWE-601) in Koa's response.redirect() implementation, specifically in the back redirect logic in response.js line 326. The code checks if a referrer URL starts with "/" to treat it as a safe relative path, but protocol-relative URLs like "//evil.com" also start with "/" and are passed through unchecked. When a browser receives "Location: //evil.com", it interprets this as a redirect to https://evil.com, bypassing the intended same-origin protection. An attacker can craft a request with "Referer: //attacker.com" to trigger a cross-origin redirect. User interaction is required (the user must click a crafted link). Patches are available in Koa 2.16.3 and 3.0.3.

Affected products

Koa Koa 2.16.2 through 2.16.2; 3.0.1 through 3.0.2

Identifiers

CVE-2025-62595
GHSA-g8mr-fgfg-5qpc

Timeline

2025-10-21: disclosed: Advisory published
2025-10-21: patched: Patches released in versions 2.16.3 and 3.0.3

References

https://github.com/koajs/koa/security/advisories/GHSA-g8mr-fgfg-5qpc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.