EUVD-2026-255520

fkie_cve-2025-62595

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications. This issue has been patched in version 3.0.3.

GHSA-g8mr-fgfg-5qpc — Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic

Affected: npm: koa

### Summary:

A bypass was discovered in the `Koa.js` framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications.

This vulnerability affects the code referenced in GitHub Advisory GHSA-jgmv-j7ww-jx2x (which is tracked as CVE‑2025‑54420).

### Details: The patched code attempts to treat values that `startWith('/')` as safe relative paths and only perform origin checks for absolute URLs. However, protocol‑relative URLs (those beginning with //host) also start with '/' and therefore match the startsWith('/') branch. A protocol‑relative referrer such as `//evil.com` with trailing double-slash is treated by the implementation as a safe relative path, but browsers interpret Location: //evil.com as a redirect to https://evil.com (or http:// based on context). This discrepancy allows an attacker to supply Referer: //evil.com and trigger an external redirect - bypassing the intended same‑origin protection.

### Proof of concept (PoC): Affected line of code: https://github.com/koajs/koa/blob/master/lib/response.js#L326 The problematic logic looks like:

<img width="567"…

Most recent entries from all

EUVD-2026-255520

fkie_cve-2025-62595

GHSA-g8mr-fgfg-5qpc — Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic