Malicious code in koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics (npm)

The package koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics was found to contain malicious code...

MAL-2025-24712 Malicious code in koa-callback-ursa-private (npm)

The package koa-callback-ursa-private was found to contain malicious code...

MAL-2025-37043 Malicious code in tool-koa-technocracy-ariel (npm)

The package tool-koa-technocracy-ariel was found to contain malicious code...

MAL-2025-24721 Malicious code in koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics (npm)

The package koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics was found to contain malicious code...

MAL-2025-24716 Malicious code in koa-mq (npm)

The package koa-mq was found to contain malicious code...

Open Redirect

Koa is vulnerable to Open Redirect. The vulnerability is due to improper validation of the Referrer argument in the back function of lib/response.js, which allows remote attackers to redirect users to malicious sites...

@freon4dsl/server (>=2.0.0-beta.1, <=2.0.0-beta.5), @tachybase/engine (>=1.0.21, <=1.1.2) +3 more potentially affected by CVE-2025-8129 via koa (3.0.0)

koa NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on koa and may be impacted: - @freon4dsl/server =2.0.0-beta.1, =1.0.21, =1.3.7, =1.4.0, =15.4.0, =15.4.2 Source cves: CVE-2025-8129 Source advisory: OSV:GHSA-JGMV-J7WW-JX2X...

@0xyy/elpis (>=1.0.0, <=1.0.2), @10xsai/cloudflare-router-nx-plugin (1.0.0) +1477 more potentially affected by CVE-2025-8129 via koa (>=2.0.0, <=2.16.1)

koa NPM version =2.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.1.3 - @ahua0920/elpis 1.0.0 and more Source cves: CVE-2025-8129 Source advisory: OSV:GHSA-JGMV-J7WW-JX2X...

GHSA-JGMV-J7WW-JX2X Koa Open Redirect via Referrer Header (User-Controlled)

Summary In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target. Details on the API document https://www.koajs.net/api/responseresponseredirecturl-alt, we can see:...

Koa Open Redirect via Referrer Header (User-Controlled)

Summary In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target. Details on the API document https://www.koajs.net/api/responseresponseredirecturl-alt, we can see:...

PT-2025-31355 · Koa · Koa

Name of the Vulnerable Software and Affected Versions: Koa affected versions not specified Description: The back method used for redirect operations in Koa utilizes the user-controllable Referrer header as the redirect target, creating an open redirect condition. The response.redirect function,...

Open Redirect

Overview org.webjars.npm:koa is a Koa web app framework Affected versions of this package are vulnerable to Open Redirect via the back function in lib/response.js which uses the user-controllable referrer header as the redirect target. An attacker can redirect users to arbitrary external sites by...

CVE-2025-8129 KoaJS Koa HTTP Header response.js back redirect

A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack...

koa 安全漏洞

koa is a Koa.js open source expressive middleware using node.js. A security vulnerability exists in koa 3.0.0 and earlier versions, which stems from a misbehavior of the parameter Referrer in the HTTP header processing component, which could lead to an open redirect...

CVE-2025-8129: URL Redirection to Untrusted Site

A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack...

graphql-playground

This is a repository for the GraphQL Playground, a development environment for building and testing GraphQL APIs. The repository contains several packages, including GraphQL Playground HTML, GraphQL Playground Express Middleware, GraphQL Playground Koa Middleware, and GraphQL Playground Hapi...

CVE-2023-49803

@koa/cors npm provides Cross-Origin Resource Sharing CORS for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that if an allowed origin is not provided, it will return an Access-Control-Allow-Origin header with the value of the origin from the request...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2025-32379

A flaw was found in Koa. This vulnerability allows execution of arbitrary JavaScript code via crafted user input passed to the ctx.redirect function, even after input sanitization. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red...

CVE-2025-32379

Koa is expressive middleware for Node.js using ES2017 async functions. In koa 2.16.1 and 3.0.0-alpha.5, passing untrusted user input to ctx.redirect even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5...