379 matches found
MAL-2025-148366 Malicious code in subscription-request-koa-scorpius (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c68b8002383770872ccdad0a33557462f10d80f27bd85d0cf04a9636bc71571 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-147459 Malicious code in rimraf-sync-koa-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 532009f657580cbf19bdbec5522f5677ade66238901cab4f4b3a95a524b4dd7c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-111825
Malicious code in leda-publish-koa-arcturus npm...
EUVD-2025-111912
Malicious code in koa-postgres-blaze-electron npm...
EUVD-2025-124811
Malicious code in module-koa-metalsmith-xenon npm...
MAL-2025-148086 Malicious code in solis-sequelize-koa-cygnus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a29e3e8c5a3977cec9560fe30b6c2fd0263b5738ea521484c63f631986c17a31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-123862
Malicious code in pegasus-terser-mongoose-koa npm...
Malicious code in blitz-koa-umbra-fork (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 737b7cf294e87c05036c5c575e26b364c9f2e68a45faceeedc422a66b098830d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps
Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.11.1 Vulnerability Details CVEID:CVE-2025-8129 DESCRIPTION: A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js o...
SUSE CVE-2025-62595
Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate th...
CVE-2025-62595
A flaw was found in Koa. A bypass of CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This...
CVE-2025-62595
Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate th...
CVE-2025-62595 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate th...
EUVD-2025-35182
Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate th...
CVE-2025-62595 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate th...
CVE-2025-62595
KoaJS CVE-2025-62595 affects Koa until patched: versions 2.16.2–2.16.2.x before 2.16.3 and 3.0.1–3.0.2.x before 3.0.3 are vulnerable to a Referer header bypass that can force user redirects to external sites via back redirect in the HTTP header handling. Root cause: some crafted URLs are treated ...
CVE-2025-62595 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate th...
Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
Summary: A bypass was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation...
Open Redirect
Overview koa is a Koa web app framework Affected versions of this package are vulnerable to Open Redirect via the "back redirect" functionality. An attacker can cause users to be redirected to an external, attacker-controlled domain by supplying a specially crafted Referer header containing a...
