Cross-Site Scripting Vulnerability in Koa Middleware by Node.js
CVE-2025-32379

5MEDIUM

Key Information:

Vendor

Koajs

Status
Koa
Vendor
CVE Published:
9 April 2025

What is CVE-2025-32379?

Koa Middleware, designed for Node.js, is susceptible to a Cross-Site Scripting (XSS) vulnerability when handling untrusted user input with the ctx.redirect() method. Even when input is sanitized, attackers could exploit this weakness to inject malicious JavaScript code, compromising user sessions and integrity. Users running versions below 2.16.1 and 3.0.0-alpha.5 are at risk. The issue has been addressed in the updated releases.

Affected Version(s)

koa >= 3.0.0-alpha.0, < 3.0.0-alpha.5 < 3.0.0-alpha.0, 3.0.0-alpha.5

koa < 2.16.1 < 2.16.1

References

https://github.com/koajs/koa/security/advisories/GHSA-x2r...
x_refsource_CONFIRM
https://github.com/koajs/koa/commit/ff25eb4a7f2392df46481...
x_refsource_MISC

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-32379 : Cross-Site Scripting Vulnerability in Koa Middleware by Node.js