Executive brief
Koa is a popular Node.js web framework used to build web applications and APIs. A vulnerability in Koa's redirect functionality allows an attacker to redirect users to arbitrary external websites by crafting a request with a malicious Referrer header. An attacker could exploit this to conduct phishing attacks, credential theft, or spread malware by tricking users into visiting attacker-controlled sites.
Technical details
The vulnerability is an open redirect (CWE-601) in the `back()` method of Koa's HTTP response handler (lib/response.js). The method uses the user-controlled Referrer header to determine the redirect target without validation, allowing an attacker to specify an arbitrary URL. The attack is network-accessible and requires minimal preconditions: an attacker sends a request with a malicious Referrer header to a route using `ctx.redirect('back')`. The vulnerability affects Koa versions up to 3.0.0 and is fixed in version 3.0.1.
Affected products
- KoaJS Koa up to 3.0.0
Timeline
- 2025-07-08: disclosed
- 2025-07-25: advisory
- 2025-07-29: other: Advisory withdrawn as duplicate of GHSA-jgmv-j7ww-jx2x
- 2025: patched: Fixed in version 3.0.1