Update dependency koa to v2.16.2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
koa (source)	2.15.3 → 2.16.2

---

Inefficient Regular Expression Complexity in koa

CVE-2025-25200 / GHSA-593f-38f6-jp5m

More information

Details

Summary

Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.

PoC

Coming soon.

Impact

This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.

Severity

• CVSS Score: 9.2 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References

• https://github.com/koajs/koa/security/advisories/GHSA-593f-38f6-jp5m
• https://nvd.nist.gov/vuln/detail/CVE-2025-25200
• https://github.com/koajs/koa/commit/5054af6e31ffd451a4151a1fe144cef6e5d0d83c
• https://github.com/koajs/koa/commit/5f294bb1c7c8d9c61904378d250439a321bffd32
• https://github.com/koajs/koa/commit/93fe903fc966635a991bcf890cfc3427d33a1a08
• https://github.com/koajs/koa/releases/tag/2.15.4
• https://github.com/advisories/GHSA-593f-38f6-jp5m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function

CVE-2025-32379 / GHSA-x2rg-q646-7m2v

More information

Details

Summary

In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.

Patches

This issue is patched in 2.16.1 and 3.0.0-alpha.5.

PoC

Coming soon...

Impact

1. Redirect user to another phishing site
2. Make request to another endpoint of the application based on user's cookie
3. Steal user's cookie

Severity

• CVSS Score: 5.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

References

• https://github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v
• https://github.com/koajs/koa/commit/ff25eb4a7f2392df46481fe86355161067687312
• https://nvd.nist.gov/vuln/detail/CVE-2025-32379
• https://github.com/advisories/GHSA-x2rg-q646-7m2v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Koa Open Redirect via Referrer Header (User-Controlled)

CVE-2025-8129 / GHSA-jgmv-j7ww-jx2x

More information

Details

Summary

In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target.

Details

on the API document https://www.koajs.net/api/response#responseredirecturl-alt, we can see:

response.redirect(url, [alt])

Performs a [302] redirect to url.
The string "back" is specially provided for Referrer support, using alt or "/" when Referrer does not exist.

ctx.redirect('back');
ctx.redirect('back', '/index.html');
ctx.redirect('/login');
ctx.redirect('http://google.com');

however, the "back" method is insecure:

• https://github.com/koajs/koa/blob/master/lib/response.js#L322

  back (alt) {
    const url = this.ctx.get('Referrer') || alt || '/'
    this.redirect(url)
  },

Referrer Header is User-Controlled.

PoC

there is a demo for POC:

const Koa = require('koa')
const serve = require('koa-static')
const Router = require('@​koa/router')
const path = require('path')

const app = new Koa()
const router = new Router()

// Serve static files from the public directory
app.use(serve(path.join(__dirname, 'public')))

// Define routes
router.get('/test', ctx => {
  ctx.redirect('back', '/index1.html')
})

router.get('/test2', ctx => {
  ctx.redirect('back')
})

router.get('/', ctx => {
  ctx.body = 'Welcome to the home page! Try accessing /test, /test2'
})

app.use(router.routes())
app.use(router.allowedMethods())

const port = 3000
app.listen(port, () => {
  console.log(`Server running at http://localhost:${port}`)
}) 

Proof Of Concept

GET /test HTTP/1.1
Host: 127.0.0.1:3000
Referer: http://www.baidu.com
Connection: close

GET /test2 HTTP/1.1
Host: 127.0.0.1:3000
Referer: http://www.baidu.com
Connection: close

Impact

https://learn.snyk.io/lesson/open-redirect/

Severity

• CVSS Score: 2.0 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

References

• https://github.com/koajs/koa/security/advisories/GHSA-jgmv-j7ww-jx2x
• https://nvd.nist.gov/vuln/detail/CVE-2025-54420
• https://github.com/koajs/koa/issues/1892
• https://github.com/koajs/koa/issues/1892#issue-3213028583
• https://github.com/koajs/koa/commit/422c551c63d00f24e2bbbdf492f262a5935bb1f0
• https://vuldb.com/?ctiid.317514
• https://vuldb.com/?id.317514
• https://vuldb.com/?submit.619741
• https://github.com/advisories/GHSA-jgmv-j7ww-jx2x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

koajs/koa (koa)

v2.16.2

Compare Source

What's Changed

• fix: only allow back redirect to the same origin referer by @​fengmk2 in #​1898

Full Changelog: koajs/koa@v2.16.1...v2.16.2

v2.16.1

Compare Source

fix: don't render redirect values in anchor ref

v2.16.0

Compare Source

This is a backported release to fix core underlying issue with HEAD requests when using http2.createSecureServer. See discussion at #​1593 and #​1547.

• fix missing cleanup, if response socket is no longer writeable (issue 1547) (#​1593) 399cb6b

v2.15.4

Compare Source

Full Changelog: koajs/koa@2.15.3...2.15.4

Fix: avoid redos on host and protocol getter, see GHSA-593f-38f6-jp5m

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
knzklive2-web	Ready	Preview, Comment	Apr 27, 2026 10:09pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	koa@​2.16.2

View full report