CVE-2025-62595

Katalog CVE

CVSS 6.1 · Medium EPSS 0,30%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada koajs koa. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications. This issue has been patched in version 3.0.3.

Rincian

Terbit di NVD

21 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/koajs/koa/security/advisories/GHSA-g8mr-fgfg-5qpc exploit · advisory vendor
• https://github.com/koajs/koa/commit/769fd75cc6b30d72493b370b5a3ae2332ca03c5b patch