401 matches found
@10xsai/cloudflare-router-nx-plugin (=1.0.0), @24hr/content-next (>=1.0.0 <=3.0.17) +828 more potentially affected by CVE-2025-54420 +1 more via koa (>=2.0.0 <=2.16.1)
koa NPM version =2.0.0, =1.0.0, =3.10.1, =3.7.0, =4.25.19-patch.1, =0.0.1, =0.3.1, =0.0.1, =0.0.50, =0.0.7, =1.0.1, =0.0.0, =0.43.0 and more Source cves: CVE-2025-54420, CVE-2025-8129 Source advisory: OSV:GHSA-JGMV-J7WW-JX2X...
GHSA-JGMV-J7WW-JX2X Koa Open Redirect via Referrer Header (User-Controlled)
Summary In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target. Details on the API document https://www.koajs.net/api/responseresponseredirecturl-alt, we can see:...
Koa Open Redirect via Referrer Header (User-Controlled)
Summary In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target. Details on the API document https://www.koajs.net/api/responseresponseredirecturl-alt, we can see:...
PT-2025-31355 · Koa · Koa
Name of the Vulnerable Software and Affected Versions: Koa affected versions not specified Description: The back method used for redirect operations in Koa utilizes the user-controllable Referrer header as the redirect target, creating an open redirect condition. The response.redirect function,...
Open Redirect
Overview org.webjars.npm:koa is a Koa web app framework Affected versions of this package are vulnerable to Open Redirect via the back function in lib/response.js which uses the user-controllable referrer header as the redirect target. An attacker can redirect users to arbitrary external sites by...
CVE-2025-8129 KoaJS Koa HTTP Header response.js back redirect
A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack...
koa 安全漏洞
koa is a Koa.js open source expressive middleware using node.js. A security vulnerability exists in koa 3.0.0 and earlier versions, which stems from a misbehavior of the parameter Referrer in the HTTP header processing component, which could lead to an open redirect...
graphql-playground
This is a repository for the GraphQL Playground, a development environment for building and testing GraphQL APIs. The repository contains several packages, including GraphQL Playground HTML, GraphQL Playground Express Middleware, GraphQL Playground Koa Middleware, and GraphQL Playground Hapi...
CVE-2023-49803
@koa/cors npm provides Cross-Origin Resource Sharing CORS for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that if an allowed origin is not provided, it will return an Access-Control-Allow-Origin header with the value of the origin from the request...
CVE-2020-8176
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...
CVE-2025-32379
A flaw was found in Koa. This vulnerability allows execution of arbitrary JavaScript code via crafted user input passed to the ctx.redirect function, even after input sanitization. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red...
CVE-2025-32379
Koa is expressive middleware for Node.js using ES2017 async functions. In koa 2.16.1 and 3.0.0-alpha.5, passing untrusted user input to ctx.redirect even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5...
CVE-2025-32379 XSS at ctx.redirect() function in Koajs
Koa is expressive middleware for Node.js using ES2017 async functions. In koa 2.16.1 and 3.0.0-alpha.5, passing untrusted user input to ctx.redirect even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5...
CVE-2025-32379 XSS at ctx.redirect() function in Koajs
Koa is expressive middleware for Node.js using ES2017 async functions. In koa 2.16.1 and 3.0.0-alpha.5, passing untrusted user input to ctx.redirect even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5...
CVE-2025-32379
CVE-2025-32379 (Koa, Node.js): In koa < 2.16.1 and
CVE-2025-32379 XSS at ctx.redirect() function in Koajs
Koa is expressive middleware for Node.js using ES2017 async functions. In koa 2.16.1 and 3.0.0-alpha.5, passing untrusted user input to ctx.redirect even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5...
3dshex (>=0.1.0 <=0.5.3), 91jin (>=0.1.4 <=0.1.8) +1813 more potentially affected by CVE-2025-32379 via koa (>=0.0.1 <=2.16.0)
koa NPM version =0.0.1, =0.1.0, =0.1.4, =1.0.0, =1.0.0, =0.1.0, =3.10.1, =3.7.0, =4.25.19-patch.1, =0.0.1, =0.3.1, =0.0.1, =0.0.94 and more Source cves: CVE-2025-32379 Source advisory: OSV:GHSA-X2RG-Q646-7M2V...
Cross-site Scripting (XSS)
Overview org.webjars.npm:koa is a Koa web app framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ctx.redirect function. An attacker can execute scripts on the user's browser or redirect users to malicious sites by supplying malicious input as an achor...
Koa 跨站脚本漏洞
Koa is an open source middleware for Koa.js. A cross-site scripting vulnerability exists in Koa versions prior to 2.16.1 and 3.0.0-alpha.5, which stems from the fact that passing untrusted user input to ctx.redirect may result in the execution of javascript code...
PT-2025-15755
Name of the Vulnerable Software and Affected Versions: Koa versions prior to 2.16.1 Koa versions prior to 3.0.0-alpha.5 Description: The issue arises when passing untrusted user input to ctx.redirect, which can execute JavaScript code on the user's device, even after sanitizing the input...