CVE-2025-32379: Koajs Koa XSS Vulnerability

CVE-2025-32379 Overview

CVE-2025-32379 is a reflected Cross-Site Scripting (XSS) vulnerability in Koa, an expressive middleware framework for Node.js built on ES2017 async functions. The flaw affects Koa versions prior to 2.16.1 and 3.0.0-alpha.5. When untrusted user input is passed to ctx.redirect(), the redirect URL is rendered inside an HTML anchor tag in the response body. Even sanitized input can trigger JavaScript execution in the victim's browser because of how the anchor markup is generated. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session by crafting malicious redirect URLs, enabling session theft, credential harvesting, and further client-side attacks.

Affected Products

Koa versions prior to 2.16.1
Koa 3.0.0-alpha.0 through 3.0.0-alpha.4
Node.js applications using ctx.redirect() with untrusted input

Discovery Timeline

2025-04-09 - CVE-2025-32379 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32379

Vulnerability Analysis

The vulnerability exists in Koa's ctx.redirect() implementation within lib/response.js. When a client accepts text/html, Koa generates a fallback HTML body containing an anchor tag that references the redirect target. The URL is escaped and inserted into both the href attribute and the visible link text. This dual-rendering pattern combined with the anchor construction allows crafted input to break out of the intended context and execute script code in the browser. Developers who sanitize input before calling ctx.redirect() remain vulnerable because the framework itself constructs the HTML response.

Root Cause

The root cause is unsafe HTML template construction in the redirect response. Koa generated the body as Redirecting to <a href="${url}">${url}</a>., embedding the URL twice in an HTML context. Even with URL escaping applied, the anchor tag structure allowed attacker-controlled values to reach a JavaScript execution sink under specific browsers or with specific URL schemes such as javascript:.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL that causes the target application to invoke ctx.redirect() with attacker-controlled input, then lures a victim to click it. When the victim's browser renders the HTML fallback body instead of following the 3xx redirect immediately, the injected payload executes in the origin of the vulnerable Koa application.

javascript

// Security patch in lib/response.js
// Source: https://github.com/koajs/koa/commit/ff25eb4a7f2392df46481fe86355161067687312
     if (this.ctx.accepts('html')) {
       url = escape(url)
       this.type = 'text/html; charset=utf-8'
-      this.body = `Redirecting to <a href="${url}">${url}</a>.`
+      this.body = `Redirecting to ${url}.`
       return
     }

The patch removes the anchor tag from the fallback body. The URL is still escaped and displayed as plain text, eliminating the HTML injection sink while preserving the redirect behavior.

Detection Methods for CVE-2025-32379

Indicators of Compromise

HTTP responses from Koa applications containing Redirecting to <a href= patterns with suspicious URL schemes such as javascript: or data:.
Web server access logs showing redirect endpoints called with encoded script payloads or unusual URL characters like ", >, or <.
Browser console errors or Content Security Policy (CSP) violations originating from redirect response pages.

Detection Strategies

Perform software composition analysis (SCA) on Node.js projects to identify Koa versions below 2.16.1 or 3.0.0-alpha.5 in package-lock.json and yarn.lock files.
Audit application source code for calls to ctx.redirect() that accept request-derived data such as ctx.query, ctx.request.body, or header values.
Deploy web application firewall (WAF) rules that inspect redirect endpoint parameters for HTML metacharacters and dangerous URL schemes.

Monitoring Recommendations

Log all outbound Location headers and 3xx response bodies from Koa services for correlation and forensic review.
Monitor client-side telemetry for CSP violations tied to inline script execution on redirect response pages.
Track dependency versions across CI/CD pipelines and alert when vulnerable Koa releases are introduced.

How to Mitigate CVE-2025-32379

Immediate Actions Required

Upgrade Koa to 2.16.1 for the 2.x branch or 3.0.0-alpha.5 for the 3.x pre-release branch.
Inventory all Node.js applications using Koa and prioritize services that expose redirect endpoints to unauthenticated users.
Review application code paths that pass user-controlled input to ctx.redirect() and enforce allow-list validation of redirect targets.

Patch Information

The fix was committed in koajs/koa commit ff25eb4 and published in Koa 2.16.1 and 3.0.0-alpha.5. The full advisory is available at GitHub Security Advisory GHSA-x2rg-q646-7m2v.

Workarounds

Validate redirect targets against a strict allow-list of internal paths or trusted domains before calling ctx.redirect().
Reject URL values containing schemes other than http: and https: and strip control characters from user input.
Enforce a restrictive Content Security Policy that blocks inline script execution to reduce the impact of reflected XSS.

bash

# Upgrade Koa to a patched version
npm install koa@^2.16.1

# Or for 3.x pre-release users
npm install koa@3.0.0-alpha.5

# Verify installed version
npm ls koa