Koa Open Redirect via Referrer Header (User-Controlled)
Summary
In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target.
Details
on the API document https://www.koajs.net/api/response#responseredirecturl-alt, we can see:
response.redirect(url, [alt])
Performs a [302] redirect to url.
The string "back" is specially provided for Referrer support, using alt or "/" when Referrer does not exist.
ctx.redirect('back');
ctx.redirect('back', '/index.html');
ctx.redirect('/login');
ctx.redirect('http://google.com');however, the "back" method is insecure:
back (alt) {
const url = this.ctx.get('Referrer') || alt || '/'
this.redirect(url)
},Referrer Header is User-Controlled.
PoC
there is a demo for POC:
const Koa = require('koa')
const serve = require('koa-static')
const Router = require('@koa/router')
const path = require('path')
const app = new Koa()
const router = new Router()
// Serve static files from the public directory
app.use(serve(path.join(__dirname, 'public')))
// Define routes
router.get('/test', ctx => {
ctx.redirect('back', '/index1.html')
})
router.get('/test2', ctx => {
ctx.redirect('back')
})
router.get('/', ctx => {
ctx.body = 'Welcome to the home page! Try accessing /test, /test2'
})
app.use(router.routes())
app.use(router.allowedMethods())
const port = 3000
app.listen(port, () => {
console.log(`Server running at http://localhost:${port}`)
})Proof Of Concept
GET /test HTTP/1.1
Host: 127.0.0.1:3000
Referer: http://www.baidu.com
Connection: close
GET /test2 HTTP/1.1
Host: 127.0.0.1:3000
Referer: http://www.baidu.com
Connection: closeImpact
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | koa | >= 2.0.0, < 2.16.2, >= 3.0.0-alpha.0, < 3.0.1 | 2.16.2, 3.0.1 |
References
- https://github.com/koajs/koa/security/advisories/GHSA-jgmv-j7ww-jx2x
- https://nvd.nist.gov/vuln/detail/CVE-2025-54420
- https://github.com/koajs/koa/issues/1892
- https://github.com/koajs/koa/issues/1892#issue-3213028583
- https://github.com/koajs/koa/commit/422c551c63d00f24e2bbbdf492f262a5935bb1f0
- https://github.com/koajs/koa
- https://vuldb.com/?ctiid.317514
- https://vuldb.com/?id.317514
- https://vuldb.com/?submit.619741
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-601- Platform
- npm
- Package
koa- Disclosed
- 29.07.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-jgmv-j7ww-jx2x - CC BY 4.0
Vulnerability history: koa
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 02.2025 02.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
- Medium 2
- Low 1
Disclosures per year
- 2025: 4
- 2026: 1
-
Koa Open Redirect via Referrer Header (User-Controlled) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.