fix(deps): update dependency koa to v2.16.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
koa (source)	2.13.0 → 2.16.1

---

Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function

CVE-2025-32379 / GHSA-x2rg-q646-7m2v

More information

Details

Summary

In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.

Patches

This issue is patched in 2.16.1 and 3.0.0-alpha.5.

PoC

Coming soon...

Impact

1. Redirect user to another phishing site
2. Make request to another endpoint of the application based on user's cookie
3. Steal user's cookie

Severity

• CVSS Score: 5.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

References

• https://github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v
• https://github.com/koajs/koa/commit/ff25eb4a7f2392df46481fe86355161067687312
• https://nvd.nist.gov/vuln/detail/CVE-2025-32379
• https://github.com/advisories/GHSA-x2rg-q646-7m2v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

koajs/koa (koa)

v2.16.1

Compare Source

fix: don't render redirect values in anchor ref

v2.16.0

Compare Source

This is a backported release to fix core underlying issue with HEAD requests when using http2.createSecureServer. See discussion at #​1593 and #​1547.

• fix missing cleanup, if response socket is no longer writeable (issue 1547) (#​1593) 399cb6b

v2.15.4

Compare Source

Full Changelog: koajs/koa@2.15.3...2.15.4

Fix: avoid redos on host and protocol getter, see GHSA-593f-38f6-jp5m

v2.15.3

Compare Source

v2.15.2

Compare Source

v2.15.1

Compare Source

v2.15.0

Compare Source

v2.14.2

Compare Source

v2.14.1

Compare Source

v2.14.0

Compare Source

v2.13.4

Compare Source

v2.13.3

Compare Source

v2.13.2

Compare Source

v2.13.1

Compare Source

==================

fixes

• [b5472f4] - fix: make ESM transpiled CommonJS play nice for TS folks, fix #​1513 (#​1518) (miwnwski <m@iwnw.ski>)
• [68d97d6] - fix: fixed order of vulnerability disclosure addresses (niftylettuce <niftylettuce@gmail.com>)

others

• [b4398f5] - correct verb tense in doc (#​1512) (Matan Shavit <71092861+matanshavit@users.noreply.github.com>)
• [39e1a5a] - fixed multiple grammatical errors in docs. (#​1497) (Hridayesh Sharma <<vyasriday7@​gmail.com>>)
• [aeb5d19] - docs: added niftylettuce@gmail.com to vulnerability disclosure (niftylettuce <niftylettuce@gmail.com>)
• [6e1093b] - docs: remove babel from readme (#​1494) (miwnwski <m@iwnw.ski>)
• [38cb591] - docs: update specific for auto response status (AlbertAZ1992 <ziyuximing@163.com>)
• [2224cd9] - docs: remove babel ref. (#​1488) (Imed Jaberi <imed_jebari@hotmail.fr>)
• [d51f983] - docs: fix assert example for response (#​1489) (Imed Jaberi <imed_jebari@hotmail.fr>)
• [f8b49b8] - chore: fix grammatical and spelling errors in comments and tests (#​1490) (Matt Kubej <mkubej@gmail.com>)
• [d1c9263] - deps: update depd >> v2.0.0 (#​1482) (imed jaberi <imed_jebari@hotmail.fr>)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.