Koajs Koa 3.0.0 Alpha 1 for Node.js

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:koajs:koa:3.0.0:alpha1:*:*:*:node.js:*:*

part: a version: 3.0.0 update: alpha1

VendorKoajs (b257484d-9724-5405-ad62-508d7bec639f)
ProductKoa (6066500b-3581-5095-8439-89afd116bbd4)
Edition*
Language*
Software edition*
Target softwarenode.js
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/koajs/koa purl2cpe 2026-06-01 10:12:48.309536
pkg:npm/koa purl2cpe 2026-06-01 10:12:48.309537

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-8129 vulnerable 2026-06-08 07:45:19.672971 KoaJS Koa HTTP Header response.js back redirect
LOW (3.5)
A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Published: 2025-07-25T04:02:05.418Z
Updated: 2025-07-25T12:01:53.033Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-32379 vulnerable 2026-06-08 07:18:59.694664 XSS at ctx.redirect() function in Koajs
MEDIUM (5)
Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.
Published: 2025-04-09T15:56:40.574Z
Updated: 2025-04-09T20:45:15.899Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-25200 vulnerable 2026-06-08 07:12:50.834828 Koa has Inefficient Regular Expression Complexity
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
Published: 2025-02-12T17:59:04.615Z
Updated: 2025-02-12T19:29:10.232Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.