{
  "@id": "urn:uuid:28819fbf-4587-4704-8f3a-8ee5a95b45f1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T11:34:00.045631+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/koa@3.1.2",
          "identifiers": {
            "purl": "pkg:npm/koa@3.1.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:34:00.116347+00:00",
      "status_notes": "Vulnerability CVE-2025-25200 affects version 3.1.2 of koa.",
      "vulnerability": {
        "name": "CVE-2025-25200"
      },
      "action_statement": "Vulnerability CVE-2025-25200 affects version 3.1.2 of koa."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/koa@3.1.2",
          "identifiers": {
            "purl": "pkg:npm/koa@3.1.2"
          }
        }
      ],
      "timestamp": "2026-11-04T11:22:00.060275+00:00",
      "status_notes": "Vulnerability CVE-2025-32379 does not affect version 3.1.2 of koa. not_affected \u2014 The target version koa 3.1.2 is not affected by CVE-2025-32379. The vulnerability involved rendering user-controlled URLs inside HTML anchor tags in redirect responses, allowing JavaScript execution via javascript: URLs. The upstream vendor (jongleberry) removed the vulnerable anchor tag on 2025-04-06 (commit ff25eb4a), and this fix was included in the 3.1.2 release (2026-02-25). The current co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-32379"
      },
      "impact_statement": "not_affected \u2014 The target version koa 3.1.2 is not affected by CVE-2025-32379. The vulnerability involved rendering user-controlled URLs inside HTML anchor tags in redirect responses, allowing JavaScript execution via javascript: URLs. The upstream vendor (jongleberry) removed the vulnerable anchor tag on 2025-04-06 (commit ff25eb4a), and this fix was included in the 3.1.2 release (2026-02-25). The current co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/koa@3.1.2",
          "identifiers": {
            "purl": "pkg:npm/koa@3.1.2"
          }
        }
      ],
      "timestamp": "2026-11-04T11:34:00.045631+00:00",
      "status_notes": "Vulnerability CVE-2025-62595 does not affect version 3.1.2 of koa. not_affected \u2014 CVE-2025-62595: Protocol-relative URL redirect vulnerability is NOT present in target version 3.1.2. The vulnerable pattern (treating referrers starting with '/' as safe without normalization) was removed by upstream in version 3.0.3 (commit 769fd75). Target version 3.1.2 includes this upstream fix - all referrer values are normalized through URL parsing before host comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-62595"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-62595: Protocol-relative URL redirect vulnerability is NOT present in target version 3.1.2. The vulnerable pattern (treating referrers starting with '/' as safe without normalization) was removed by upstream in version 3.0.3 (commit 769fd75). Target version 3.1.2 includes this upstream fix - all referrer values are normalized through URL parsing before host comparison."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/koa@3.1.2",
          "identifiers": {
            "purl": "pkg:npm/koa@3.1.2"
          }
        }
      ],
      "timestamp": "2026-11-04T11:34:00.045631+00:00",
      "status_notes": "Vulnerability CVE-2025-8129 does not affect version 3.1.2 of koa. not_affected \u2014 CVE-2025-8129 describes an open redirect vulnerability in koa's `back()` redirect method, which used the user-controllable Referrer header without validation. The target repository (koa v3.1.2) is NOT AFFECTED because the fix was already shipped in the upstream release. The vulnerable pattern (unconditional use of Referrer header for redirects) is not present in the target. The fix (same-origin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-8129"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-8129 describes an open redirect vulnerability in koa's `back()` redirect method, which used the user-controllable Referrer header without validation. The target repository (koa v3.1.2) is NOT AFFECTED because the fix was already shipped in the upstream release. The vulnerable pattern (unconditional use of Referrer header for redirects) is not present in the target. The fix (same-origin..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/koa@3.1.2",
          "identifiers": {
            "purl": "pkg:npm/koa@3.1.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:34:00.116347+00:00",
      "status_notes": "Vulnerability CVE-2026-27959 affects version 3.1.2 of koa.",
      "vulnerability": {
        "name": "CVE-2026-27959"
      },
      "action_statement": "Vulnerability CVE-2026-27959 affects version 3.1.2 of koa."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/koa@3.1.2",
          "identifiers": {
            "purl": "pkg:npm/koa@3.1.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:34:00.116347+00:00",
      "status_notes": "Vulnerability GHSA-mvw6-62qv-vmqf is a false positive for koa 3.1.2.",
      "vulnerability": {
        "name": "GHSA-mvw6-62qv-vmqf"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}