chore(deps): update dependency koa to v3 [security] - autoclosed by renovate-bot · Pull Request #772 · googleapis/nodejs-error-reporting

renovate-bot · 2025-07-28T20:59:10Z

This PR contains the following updates:

Package	Change	Age	Confidence
koa (source)	`^2.7.0` -> `^3.0.1`

GitHub Vulnerability Alerts

CVE-2025-8129

Summary

In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target.

Details

on the API document https://www.koajs.net/api/response#responseredirecturl-alt, we can see:

response.redirect(url, [alt])

Performs a [302] redirect to url.
The string "back" is specially provided for Referrer support, using alt or "/" when Referrer does not exist.

ctx.redirect('back');
ctx.redirect('back', '/index.html');
ctx.redirect('/login');
ctx.redirect('http://google.com');

however, the "back" method is insecure:

https://github.com/koajs/koa/blob/master/lib/response.js#L322

  back (alt) {
    const url = this.ctx.get('Referrer') || alt || '/'
    this.redirect(url)
  },

Referrer Header is User-Controlled.

PoC

there is a demo for POC:

const Koa = require('koa')
const serve = require('koa-static')
const Router = require('@&#8203;koa/router')
const path = require('path')

const app = new Koa()
const router = new Router()

// Serve static files from the public directory
app.use(serve(path.join(__dirname, 'public')))

// Define routes
router.get('/test', ctx => {
  ctx.redirect('back', '/index1.html')
})

router.get('/test2', ctx => {
  ctx.redirect('back')
})

router.get('/', ctx => {
  ctx.body = 'Welcome to the home page! Try accessing /test, /test2'
})

app.use(router.routes())
app.use(router.allowedMethods())

const port = 3000
app.listen(port, () => {
  console.log(`Server running at http://localhost:${port}`)
})

Proof Of Concept

GET /test HTTP/1.1
Host: 127.0.0.1:3000
Referer: http://www.baidu.com
Connection: close

GET /test2 HTTP/1.1
Host: 127.0.0.1:3000
Referer: http://www.baidu.com
Connection: close

Impact

https://learn.snyk.io/lesson/open-redirect/

Release Notes

koajs/koa (koa)

`v3.0.1`

Compare Source

What's Changed

fix(security): only allow same origin referer on response back koajs/koa@422c551
chore: adds initial doc text refresh; migration guide [CHORE-1870] by @yowainwright in https://github.com/koajs/koa/pull/1877
build(deps-dev): bump formidable from 3.5.2 to 3.5.4 by @dependabot[bot] inhttps://github.com/koajs/koa/pull/18788
chore: removes done callbacks in tests [CHORE-1870] by @yowainwright in https://github.com/koajs/koa/pull/1875
build(deps-dev): bump supertest from 7.1.0 to 7.1.1 by @dependabot[bot] inhttps://github.com/koajs/koa/pull/18799
build(deps): bump debug from 4.4.0 to 4.4.1 by @dependabot[bot] inhttps://github.com/koajs/koa/pull/18800
feat: replace debug module with pure node:util::debuglog by @3imed-jaberi in https://github.com/koajs/koa/pull/1885
feat: replace cache-content-type with mime-types directly by @3imed-jaberi in https://github.com/koajs/koa/pull/1886
build(deps): bump statuses from 2.0.1 to 2.0.2 by @dependabot[bot] inhttps://github.com/koajs/koa/pull/18888
build(deps-dev): bump supertest from 7.1.1 to 7.1.4 by @dependabot[bot] inhttps://github.com/koajs/koa/pull/18955
build(deps-dev): bump form-data from 4.0.3 to 4.0.4 by @dependabot[bot] inhttps://github.com/koajs/koa/pull/18944

Full Changelog: koajs/koa@v3.0.0...v3.0.1

`v3.0.0`

Compare Source

==================

fixes

Avoid redos on host and protocol getter

`v2.16.2`

Compare Source

What's Changed

fix: only allow back redirect to the same origin referer by @fengmk2 in https://github.com/koajs/koa/pull/1898

Full Changelog: koajs/koa@v2.16.1...v2.16.2

`v2.16.1`

Compare Source

fix: don't render redirect values in anchor ref

`v2.16.0`

Compare Source

This is a backported release to fix core underlying issue with HEAD requests when using http2.createSecureServer. See discussion at https://github.com/koajs/koa/pull/1593 and https://github.com/koajs/koa/issues/1547.

fix missing cleanup, if response socket is no longer writeable (issue 1547) (https://github.com/koajs/koa/pull/1593) 399cb6b

`v2.15.4`

Compare Source

Full Changelog: koajs/koa@2.15.3...2.15.4

Fix: avoid redos on host and protocol getter, see GHSA-593f-38f6-jp5m

==================

fixes

[b5472f4] - fix: make ESM transpiled CommonJS play nice for TS folks, fix #1513 (#1518) (miwnwski <m@iwnw.ski>)
[68d97d6] - fix: fixed order of vulnerability disclosure addresses (niftylettuce <niftylettuce@gmail.com>)

others

[b4398f5] - correct verb tense in doc (#1512) (Matan Shavit <71092861+matanshavit@users.noreply.github.com>)
[39e1a5a] - fixed multiple grammatical errors in docs. (#1497) (Hridayesh Sharma <<vyasriday7@gmail.com>>)
[aeb5d19] - docs: added niftylettuce@gmail.com to vulnerability disclosure (niftylettuce <niftylettuce@gmail.com>)
[6e1093b] - docs: remove babel from readme (#1494) (miwnwski <m@iwnw.ski>)
[38cb591] - docs: update specific for auto response status (AlbertAZ1992 <ziyuximing@163.com>)
[2224cd9] - docs: remove babel ref. (#1488) (Imed Jaberi <imed_jebari@hotmail.fr>)
[d51f983] - docs: fix assert example for response (#1489) (Imed Jaberi <imed_jebari@hotmail.fr>)
[f8b49b8] - chore: fix grammatical and spelling errors in comments and tests (#1490) (Matt Kubej <mkubej@gmail.com>)
[d1c9263] - deps: update depd >> v2.0.0 (#1482) (imed jaberi <imed_jebari@hotmail.fr>)

`v2.13.0`

Compare Source

==================

features

[bbcde76] - feat: support esm (#1474) (ZYSzys <zhangyongsheng@youzan.com>)

others

[20e58cf] - test: imporve coverage to 100% (dead-horse <dead_horse@qq.com>)
[4a40d63] - build: use prepare instead of prepublish (dead-horse <dead_horse@qq.com>)
[226ba8c] - build: use prepublish instead of prepack (dead-horse <dead_horse@qq.com>)

`v2.12.1`

Compare Source

==================

fixes

[e2030c7] - fix: Improve checks for Error in onerror handlers (#1468) (Julien Wajsberg <felash@gmail.com>)

others

[5208c5e] - chore: Use single console.error() statement in error handler (#1471) (Mike Vosseller <michael.vosseller@gmail.com>)

`v2.12.0`

Compare Source

==================

features

[0d2f421] - feat: error handler treat err.statusCode as the same as err.status (#1460) (Vijay Krishnavanshi <vijaykrishnavanshi@gmail.com>)
[8d52105] - feat: allow bodyless responses for non empty status codes (#1447) (ejose19 <<8742215+ejose19@users.noreply.github.com>>)

others

[faeaff5] - fox: remove error-inject and fix error handling (#1409) (Konstantin Vyatkin <tino@vtkn.io>)
[f7c732f] - docs: fixed incorrect onerror example (#1459) (Paul Annekov <paul.annekov@gmail.com>)
[143d8f7] - Always use strict equality. (#1225) (Yazan Medanat <medanat@gmail.com>)
[6b6b0dd] - docs(api): add app.use chainability note (#1449) (Zac Anger <zac@zacanger.com>)
[8ddab48] - docs: Document response status with empty body (#1445) (Marc-Aurèle DARCHE <152407+madarche@users.noreply.github.com>)
[7deedb2] - docs: Updating context.md with the latest cookies opts (#1433) (Brad Ito <phlogisticfugu@users.noreply.github.com>)
[3e97a10] - docs(links): remove Google+ link (#1439) (laffachan <45162759+laffachan@users.noreply.github.com>)
[eda2760] - build: Drop unused Travis sudo: false directive (#1416) (Olle Jonsson <olle.jonsson@gmail.com>)

`v2.11.0`

Compare Source

==================

features

[422e539] - feat: support app.proxyIPHeader and app.maxIpsCount to make ctx.ips more security (Yiyu He <dead_horse@qq.com>)
[d48d88e] - feat: implement response.has (#1397) (Konstantin Vyatkin <tino@vtkn.io>)

others

[4dc56f6] - chore: update ESLint and plugins/configs (#1407) (Konstantin Vyatkin <tino@vtkn.io>)
[be7d334] - chore: removes code duplication at handling HEAD method (#1400) (Konstantin Vyatkin <tino@vtkn.io>)
[f155785] - chore: support writableEnded (#1402) (Konstantin Vyatkin <tino@vtkn.io>)
[b968688] - chore: add FUNDING.yml (#1403) (Konstantin Vyatkin <tino@vtkn.io>)
[4f96829] - chore: remove isJSON in res.length (#1399) (Konstantin Vyatkin <tino@vtkn.io>)
[8be5626] - build: enable codecov partial coverage and use bash uploader (#1396) (Konstantin Vyatkin <tino@vtkn.io>)
[ef5c43b] - chore: use rest params (#1393) (Konstantin Vyatkin <tino@vtkn.io>)

`v2.10.0`

Compare Source

==================

features

[d7f7f77] - feat: support sameSite=none cookies (bump cookies dependency) (#1390) (Filip Skokan <panva.ip@gmail.com>)

`v2.9.0`

Compare Source

==================

features

[2d1c598] - feat: export HttpError from http-errors library (Micheal Hill <micheal.hill@trunkplatform.com>)

others

[cf70dbc] - Chore: Use https in readme (#1389) (谭九鼎 <<109224573@qq.com>>)

`v2.8.2`

Compare Source

==================

fixes

[54e8fab] - fix: encode redirect url if not already encoded (#1384) (fengmk2 <<fengmk2@gmail.com>>)

others

[817b498] - test: fix body test (#1375) (Robert Nagy <ronagy@icloud.com>)
[f75d445] - test: fix end after end (#1374) (Robert Nagy <ronagy@icloud.com>)

`v2.8.1`

Compare Source

==================

fixes

[287e589] - fix: make options more compatibility (dead-horse <dead_horse@qq.com>)

`v2.8.0`

Compare Source

==================

features

[5afff89] - feat: accept options in the Application constructor (#1372) (Jake <djakelambert@gmail.com>)

fixes

[ff70bdc] - fix: typo on document (#1355) (Jeff <jeff.tian@outlook.com>)

others

[3b23865] - docs: parameter of request.get is case-insensitive (#1373) (Gunnlaugur Thor Briem <gunnlaugur@gmail.com>)
[a245d18] - docs: Update response.socket (#1357) (Jeff <jeff.tian@outlook.com>)
[d1d65dd] - chore(deps): install egg-bin, mm as devDeps not deps (#1366) (Edvard Chen <<pigeon73101@gmail.com>>)
[2c86b10] - test: remove jest and use egg-bin(mocha) (#1363) (Yiyu He <dead_horse@qq.com>)
[219bf22] - docs(context): update link (#1354) (Peng Jie <bivinity.pengzjie@gmail.com>)
[52a6737] - chore: ignore Intellij IDEA project files (#1361) (Imon-Haque <38266345+Imon-Haque@users.noreply.github.com>)
[b9e3546] - docs(api): fix keygrip link (#1350) (Peng Jie <bivinity.pengzjie@gmail.com>)
[d4bdb5e] - chore: update eslint and fix lint errors (dead-horse <dead_horse@qq.com>)
[12960c4] - build: test on 8/10/12 (dead-horse <dead_horse@qq.com>)
[00e8f7a] - docs: ctx.type aliases ctx.response, not ctx.request (#1343) (Alex Berk <berkalexanderc@gmail.com>)
[62f29eb] - docs(context): update cookies link (#1348) (Peng Jie <dean.leehom@gmail.com>)
[b7fc526] - docs: fix typo in cookie path default value docs (#1340) (Igor Adamenko <igoradamenko@users.noreply.github.com>)
[23f7f54] - chore: simplify variable (#1332) (kzhang <godky@users.noreply.github.com>)
[132c9ee] - docs: Clarify the format of request.headers (#1325) (Dobes Vandermeer <dobesv@gmail.com>)
[5810f27] - docs: Removed Document in Progress note in Koa vs Express (#1336) (Andrew Peterson <andrew@andpeterson.com>)
[75233d9] - chore: Consider removing this return statement; it will be ignored. (#1322) (Vern Brandl <tkvern@users.noreply.github.com>)
[04e07fd] - test: Buffer() is deprecated due to security and usability issues. so use the Buffer.alloc() instead (#1321) (Vern Brandl <tkvern@users.noreply.github.com>)
[130e363] - docs: use 'fs-extra' instead of 'fs-promise' (#1309) (rosald <35028438+rosald@users.noreply.github.com>)
[2f2078b] - chore: Update PR-welcome badge url (#1299) (James George <<jamesgeorge998001@gmail.com>>)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate-bot requested a review from a team as a code owner July 28, 2025 20:59

renovate-bot requested review from a team and gkevinzheng July 28, 2025 20:59

trusted-contributions-gcf bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Jul 28, 2025

blunderbuss-gcf bot assigned gkevinzheng Jul 28, 2025

product-auto-label bot added size: xs Pull request size is extra small. api: clouderrorreporting Issues related to the googleapis/nodejs-error-reporting API. labels Jul 28, 2025

gcf-owl-bot bot removed the owlbot:run Add this label to trigger the Owlbot post processor. label Jul 28, 2025

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 28, 2025

renovate-bot force-pushed the renovate/npm-koa-vulnerability branch from 2841a39 to 79f759e Compare July 29, 2025 02:33

trusted-contributions-gcf bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Jul 29, 2025

gcf-owl-bot bot removed the owlbot:run Add this label to trigger the Owlbot post processor. label Jul 29, 2025

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 29, 2025

renovate-bot force-pushed the renovate/npm-koa-vulnerability branch from 79f759e to dfcc1c5 Compare July 29, 2025 11:48

trusted-contributions-gcf bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Jul 29, 2025

gcf-owl-bot bot removed the owlbot:run Add this label to trigger the Owlbot post processor. label Jul 29, 2025

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 29, 2025

renovate-bot force-pushed the renovate/npm-koa-vulnerability branch from dfcc1c5 to e123585 Compare July 29, 2025 20:14

trusted-contributions-gcf bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Jul 29, 2025

gcf-owl-bot bot removed the owlbot:run Add this label to trigger the Owlbot post processor. label Jul 29, 2025

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 29, 2025

renovate-bot force-pushed the renovate/npm-koa-vulnerability branch from e123585 to 5b2bfaf Compare July 30, 2025 01:47

trusted-contributions-gcf bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Jul 30, 2025

gcf-owl-bot bot removed the owlbot:run Add this label to trigger the Owlbot post processor. label Jul 30, 2025

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 30, 2025

chore(deps): update dependency koa to v3 [security]

79e29d4

renovate-bot force-pushed the renovate/npm-koa-vulnerability branch from 5b2bfaf to 79e29d4 Compare July 30, 2025 10:55

trusted-contributions-gcf bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Jul 30, 2025

gcf-owl-bot bot removed the owlbot:run Add this label to trigger the Owlbot post processor. label Jul 30, 2025

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 30, 2025

renovate-bot changed the title ~~chore(deps): update dependency koa to v3 [security]~~ chore(deps): update dependency koa to v3 [security] - autoclosed Jul 30, 2025

renovate-bot closed this Jul 30, 2025

renovate-bot deleted the renovate/npm-koa-vulnerability branch July 30, 2025 18:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

chore(deps): update dependency koa to v3 [security] - autoclosed#772

chore(deps): update dependency koa to v3 [security] - autoclosed#772
renovate-bot wants to merge 1 commit intogoogleapis:mainfrom
renovate-bot:renovate/npm-koa-vulnerability

renovate-bot commented Jul 28, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Conversation

renovate-bot commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Summary

Details

PoC

Impact

Release Notes

What's Changed

What's Changed

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

renovate-bot commented Jul 28, 2025 •

edited

Loading