5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-32379

CVE-2025-32379: XSS at ctx.redirect() function in Koajs

Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-32379

CVE-2025-32379:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
koa	npm	< 2.16.1	2.16.1
koa	npm	>= 3.0.0-alpha.1, < 3.0.0-alpha.5	3.0.0-alpha.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description points to ctx.redirect() as the source of the XSS. The provided commit ff25eb4a7f2392df46481fe86355161067687312 shows changes in lib/response.js and __tests__/response/redirect.test.js. The critical change is in lib/response.js within the redirect method of the module.exports object (which represents the response object in Koa). Specifically, the line responsible for generating the HTML body for redirects was modified. The original line this.body = Redirecting to <a href="${url}">${url}</a>.directly embedded the (escaped) URL into an anchor tag. This is the vulnerable part, as it allows for potential XSS if the escaping mechanism can be bypassed or if the context of injection allows for it, as suggested by the advisory. The patch removes the anchor tag entirely, changing the line tothis.body = Redirecting to ${url}.``. This identifies response.redirect(as it would be called onctx.response.redirect`) as the vulnerable function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.