CVE-2025-8129

Published: Jul 25, 2025Modified: Jun 17, 2026

2.0

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected (8)

Products: Koajs: Koa

Koajs

1 product

Koa

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Koajs Koa	From 2.0.0 to 2.16.2
Koajs Koa	Version 3.0.0
Koajs Koa	Version 3.0.0 alpha0
Koajs Koa	Version 3.0.0 alpha1
Koajs Koa	Version 3.0.0 alpha2
Koajs Koa	Version 3.0.0 alpha3
Koajs Koa	Version 3.0.0 alpha4
Koajs Koa	Version 3.0.0 alpha5