Quick answers
- Is CVE-2025-8129 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-8129 being exploited in the wild.
- How severe is CVE-2025-8129?
- Low severity, with a CVSS score of 3.1, published 29 July 2025.
- Which products and versions are affected?
- koa (npm) SEMVER:introduced=2.0.0,fixed=2.16.2.
- Is there a fix for CVE-2025-8129?
- Yes. koa (npm): upgrade to 2.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-8129 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-8129?
- Check whether you run koa (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- koa (npm): upgrade to 2.16.2 or later
npm install koa@2.16.2
Technical details
This vulnerability is an open redirect (CWE-601) in Koa's response.redirect() method. The vulnerable 'back' option retrieves the redirect URL directly from the user-controlled HTTP Referrer header without validation, allowing attackers to specify arbitrary redirect targets. The attack requires network access and user interaction (the victim must follow the redirect link). An authenticated or unauthenticated attacker can craft requests with malicious Referrer headers to redirect users to attacker-controlled sites. Fixes are available in Koa 2.16.2 and 3.0.1.
Affected products
- Koa Koa 2.0.0 to 2.16.1, 3.0.0-alpha.0 to 3.0.0
Identifiers
- CVE-2025-8129
- GHSA-jgmv-j7ww-jx2x
Timeline
- 2025-07-29: disclosed
- 2025-07-29: patched: Koa 2.16.2 and 3.0.1 released