Malicious code in koa-holography-charon-blueshift (npm)

The package koa-holography-charon-blueshift was found to contain malicious code...

MAL-2025-26999 Malicious code in mysql-koa (npm)

The package mysql-koa was found to contain malicious code...

MAL-2025-24720 Malicious code in koa-speleology-greatfilter-gravitationalwave (npm)

The package koa-speleology-greatfilter-gravitationalwave was found to contain malicious code...

MAL-2025-24713 Malicious code in koa-highway (npm)

The package koa-highway was found to contain malicious code...

MAL-2025-27653 Malicious code in node-sass-exoplanet-koa-browserify (npm)

The package node-sass-exoplanet-koa-browserify was found to contain malicious code...

Malicious code in koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics (npm)

The package koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics was found to contain malicious code...

Malicious code in hyperion-koa-vuepress-zenith (npm)

The package hyperion-koa-vuepress-zenith was found to contain malicious code...

Malicious code in fetch-selenology-yaml-koa (npm)

The package fetch-selenology-yaml-koa was found to contain malicious code...

Malicious code in tool-koa-technocracy-ariel (npm)

The package tool-koa-technocracy-ariel was found to contain malicious code...

Malicious code in koa-body-parse (npm)

The package koa-body-parse was found to contain malicious code...

MAL-2025-24712 Malicious code in koa-callback-ursa-private (npm)

The package koa-callback-ursa-private was found to contain malicious code...

MAL-2025-37043 Malicious code in tool-koa-technocracy-ariel (npm)

The package tool-koa-technocracy-ariel was found to contain malicious code...

MAL-2025-24721 Malicious code in koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics (npm)

The package koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics was found to contain malicious code...

MAL-2025-24716 Malicious code in koa-mq (npm)

The package koa-mq was found to contain malicious code...

Open Redirect

Koa is vulnerable to Open Redirect. The vulnerability is due to improper validation of the Referrer argument in the back function of lib/response.js, which allows remote attackers to redirect users to malicious sites...

Koa Open Redirect via Referrer Header (User-Controlled)

Summary In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target. Details on the API document https://www.koajs.net/api/responseresponseredirecturl-alt, we can see:...

GHSA-JGMV-J7WW-JX2X Koa Open Redirect via Referrer Header (User-Controlled)

Summary In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target. Details on the API document https://www.koajs.net/api/responseresponseredirecturl-alt, we can see:...

PT-2025-31355 · Koa · Koa

Name of the Vulnerable Software and Affected Versions: Koa affected versions not specified Description: The back method used for redirect operations in Koa utilizes the user-controllable Referrer header as the redirect target, creating an open redirect condition. The response.redirect function,...

Open Redirect

Overview org.webjars.npm:koa is a Koa web app framework Affected versions of this package are vulnerable to Open Redirect via the back function in lib/response.js which uses the user-controllable referrer header as the redirect target. An attacker can redirect users to arbitrary external sites by...

CVE-2025-8129 KoaJS Koa HTTP Header response.js back redirect

A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack...