CVE-2025-62595: Koajs Koa Auth Bypass Vulnerability

CVE-2025-62595 Overview

CVE-2025-62595 is an open redirect vulnerability in the Koa.js web framework for Node.js. The flaw affects the ctx.back() redirect functionality and bypasses the earlier fix for CVE-2025-8129. Attackers can craft a malicious Referer header that Koa incorrectly treats as a safe relative path, causing the framework to redirect users to an attacker-controlled external site. The vulnerability affects Koa versions 2.16.2 before 2.16.3 and 3.0.1 before 3.0.3. Successful exploitation supports phishing, credential harvesting, and other redirect-based social engineering attacks against users of applications built on Koa. The issue is classified under CWE-601 (URL Redirection to Untrusted Site).

Critical Impact
Attackers can abuse the Referer header to redirect authenticated users to malicious sites via a bypass of the prior CVE-2025-8129 fix.

Affected Products

Koa.js versions 2.16.2 up to (but not including) 2.16.3
Koa.js versions 3.0.1 up to (but not including) 3.0.3
Node.js applications using ctx.back() or response.back() for referrer-based redirection

Discovery Timeline

2025-10-21 - CVE-2025-62595 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62595

Vulnerability Analysis

Koa is an expressive middleware framework for Node.js that uses ES2017 async functions. The back() method on the response object reads the incoming Referrer header and issues a redirect to that value, falling back to an alternate URL when no referrer is present. The prior fix for CVE-2025-8129 attempted to constrain redirects to same-origin destinations by inspecting the referrer string. However, the check that treated referrers beginning with / as safe relative paths did not normalize the input first. Attackers can supply values such as //evil.example.com or /\evil.example.com that browsers resolve as protocol-relative or scheme-relative URLs pointing to a foreign origin.

Root Cause

The root cause is insufficient input normalization in lib/response.js before the same-origin check. The vulnerable code short-circuits and calls this.redirect(referrer) whenever the referrer string starts with /, without first parsing the URL. Browsers interpret sequences like //host as network-path references, so the emitted Location header sends users off-site. The fix removes the fast path and always parses the referrer with the URL constructor before comparing url.host to this.ctx.host.

Attack Vector

Exploitation requires user interaction: a victim must follow a link that causes their browser to send an attacker-controlled Referer header to an endpoint invoking ctx.back(). This is typically achieved by hosting a page under the attacker's control that links to the target endpoint, or by chaining through a site that reflects a manipulated referrer. The server then responds with a 302 redirect to the malicious destination, and the browser follows it in the trusted context of the victim's session.

javascript

// Patch in lib/response.js — normalize referer before redirect (#1908)
 back (alt) {
   const referrer = this.ctx.get('Referrer')
   if (referrer) {
-      // referrer is a relative path
-      if (referrer.startsWith('/')) {
-        this.redirect(referrer)
-        return
-      }
-
       // referrer is an absolute URL, check if it's the same origin
       const url = new URL(referrer, this.ctx.href)
       if (url.host === this.ctx.host) {

Source: Koa commit 769fd75. The patch removes the unsafe relative-path shortcut and forces every referrer through URL parsing so the same-origin comparison operates on the resolved host.

Detection Methods for CVE-2025-62595

Indicators of Compromise

HTTP 302 responses from Koa applications with Location headers pointing to external hosts that originated from ctx.back() handlers
Inbound requests carrying Referer header values beginning with //, /\, or other patterns that resolve to a different origin
Web server access logs showing repeated requests to endpoints known to call response.back() with anomalous referrer sources

Detection Strategies

Inventory Node.js applications and identify those depending on koa at versions 2.16.2 or 3.0.1–3.0.2 using package manifests and lockfiles
Add web application firewall or reverse proxy rules that inspect the Referer header and block requests where the header does not resolve to the application's own host
Review application code for calls to ctx.back() or response.back() and log the resolved redirect target before emitting the response

Monitoring Recommendations

Alert on outbound redirects issued by Koa services where the Location host differs from the request Host header
Correlate spikes in redirect responses with phishing campaigns targeting your users or brand
Track dependency drift for koa in software composition analysis tooling and surface deployments still running vulnerable versions

How to Mitigate CVE-2025-62595

Immediate Actions Required

Upgrade Koa to version 2.16.3 for the 2.x branch or version 3.0.3 for the 3.x branch
Audit application routes that call ctx.back() and confirm they perform explicit allowlist validation of redirect destinations
Rebuild and redeploy container images and serverless bundles so pinned lockfiles pull in the patched release

Patch Information

The fix is delivered in Koa 2.16.3 and 3.0.3 via commit 769fd75cc6b30d72493b370b5a3ae2332ca03c5b. The change removes the relative-path fast path in lib/response.js and requires all referrer values to be parsed through the URL constructor before the same-origin host comparison. Details are published in the GitHub Security Advisory GHSA-g8mr-fgfg-5qpc.

Workarounds

Replace ctx.back() with a hard-coded internal redirect target until the framework is upgraded
Wrap redirect logic in a helper that validates the resolved URL.host against an allowlist of trusted origins before responding
Strip or overwrite the inbound Referer header at the reverse proxy for routes that invoke back-redirect behavior

bash

# Upgrade to a patched Koa release
npm install koa@3.0.3
# or for the 2.x branch
npm install koa@2.16.3

# Verify the installed version
npm ls koa