Bug 2383344 (CVE-2025-8129)

Summary: CVE-2025-8129 koa: KoaJS Koa HTTP Header response.js back redirect
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, jchui, jhe, ktsao, nboldt, psrna, sdawley
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Koa. An issue was discovered in the back redirect functionality, used for redirect operations. This issue allows an attacker to manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website due to an insecure implementation. This issue allows attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-07-25 05:01:11 UTC
A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the component HTTP Header Handler. The manipulation of the argument Referrer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.