CVE-2025-32379: XSS at ctx.redirect() function in Koajs
### Summary In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. ### Patches This issue is patched in 2.16.1 and 3.0.0-alpha.5. ### PoC Coming soon... ### Impact 1. Redirect user to another phishing site 2. Make request to another endpoint of the application based on user's cookie 3. Steal user's cookie
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32379?
CVE-2025-32379 has been classified as a high severity vulnerability due to its potential for executing malicious JavaScript code.
How do I fix CVE-2025-32379?
To fix CVE-2025-32379, update your koa dependency to version 2.16.1 or 3.0.0-alpha.5 or later.
Which versions of Koa are affected by CVE-2025-32379?
CVE-2025-32379 affects Koa versions earlier than 2.16.1 and 3.0.0-alpha.5.
What happens if I don't address CVE-2025-32379?
If CVE-2025-32379 is not addressed, your application may become vulnerable to cross-site scripting attacks that could compromise user data.
Is user input sanitization enough to mitigate CVE-2025-32379?
No, simply sanitizing user input is not sufficient to mitigate CVE-2025-32379 as the vulnerability persists even when input is sanitized.