{"id":"CVE-2025-61668","summary":"@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user","details":"Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.","aliases":["GHSA-m8rj-ppph-mj33"],"modified":"2026-08-12T03:51:30.613626929Z","published":"2025-10-02T21:46:32.975Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-476","CWE-754"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61668.json"},"references":[{"type":"WEB","url":"http://github.com/plone/volto/releases/tag/18.27.2"},{"type":"WEB","url":"https://github.com/plone/volto/releases/tag/16.34.1"},{"type":"WEB","url":"https://github.com/plone/volto/releases/tag/17.22.2"},{"type":"WEB","url":"https://github.com/plone/volto/releases/tag/19.0.0-alpha.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61668.json"},{"type":"ADVISORY","url":"https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61668"},{"type":"FIX","url":"https://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c"},{"type":"FIX","url":"https://github.com/plone/volto/pull/7412"},{"type":"FIX","url":"https://github.com/plone/volto/pull/7413"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/plone/volto","events":[{"introduced":"05da2b2f4703083159332cacddc60715a82c0d51"},{"fixed":"31702f552aa6d9a9d52543d711b634738426e279"},{"introduced":"92e50ee11c2150485298a95c0498af85f4396f32"},{"fixed":"5f903f5665434f61604ba0759c26b412c7e40757"},{"introduced":"c207e1ea1336e639fc08fe6525f91bdc1f237b46"},{"fixed":"48b5eb1631fdf837ecdc15fed62a726dd8826dae"},{"fixed":"4a0df986422c4ab1cd476ccf1171c3dae299be38"},{"fixed":"58d9f82d2d50ca9a87edbe16fed91762e57c109c"},{"fixed":"cb5fbdd29edd635bc119ba7a009651116d03943b"},{"fixed":"345a1491f1157ef2702b4b4267ed313d6f12cc36"},{"fixed":"b92197a7ca9bf765f6706c9ef97e1ecb5259527b"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"17.0.0"},{"fixed":"17.22.1"},{"introduced":"18.0.0"},{"fixed":"18.27.1"},{"introduced":"19.0.0-alpha.1"},{"fixed":"19.0.0-alpha.5"}]}}],"versions":["plone-scripts-4.0.0-alpha.3","plone-registry-3.0.0-alpha.6","plone-types-2.0.0-alpha.6","19.0.0-alpha.6","plone-slate-19.0.0-alpha.5","plone-registry-3.0.0-alpha.5","plone-types-2.0.0-alpha.5","17.22.1","plone-scripts-3.10.2","18.27.1","18.27.0","plone-slate-18.6.0","19.0.0-alpha.5","plone-scripts-4.0.0-alpha.2","18.26.0","18.25.0","plone-slate-18.5.1","19.0.0-alpha.4","18.24.0","plone-slate-19.0.0-alpha.4","19.0.0-alpha.3","plone-slate-19.0.0-alpha.3","plone-registry-3.0.0-alpha.4","plone-types-2.0.0-alpha.4","18.23.0","plone-slate-18.5.0","plone-registry-2.5.4","17.22.0","18.22.0","19.0.0-alpha.2","plone-slate-19.0.0-alpha.2","plone-slate-18.4.0","18.21.0","19.0.0-alpha.1","plone-types-1.4.5","18.20.0","plone-slate-19.0.0-alpha.1","plone-scripts-3.10.1","plone-scripts-3.10.0","18.19.0","plone-slate-18.3.1","18.18.0","plone-types-1.4.4","18.17.0","18.16.0","18.15.1","plone-types-1.4.3","18.15.0","plone-registry-2.5.3","plone-types-1.4.2","18.14.1","plone-registry-2.5.2","plone-types-1.4.1","18.14.0","18.13.0","plone-registry-2.5.1","plone-types-1.4.0","18.12.1","plone-types-1.3.3","18.12.0","plone-slate-18.3.0","18.11.1","18.11.0","plone-scripts-3.9.0","plone-registry-2.5.0","18.10.1","18.10.0","plone-volto-testing-5.0.0-alpha.1","18.9.2","plone-slate-18.2.3","17.21.0","18.9.1","18.9.0","18.8.2","plone-slate-18.2.2","plone-scripts-3.8.2","plone-react-router-1.0.1","generator-volto-9.0.1","plone-slots-1.0.0-alpha.1","plone-providers-1.0.0-alpha.8","plone-helpers-1.0.2","plone-blocks-1.0.0-alpha.3","plone-components-3.0.2","plone-client-1.0.0-alpha.23","plone-registry-2.4.1","plone-types-1.3.2","18.8.1","18.8.0","plone-slate-18.2.1","plone-registry-2.4.0","plone-types-1.3.1","18.7.0","plone-slate-18.2.0","plone-react-router-1.0.0","plone-theming-1.0.0-alpha.0","plone-slots-1.0.0-alpha.0","plone-blocks-1.0.0-alpha.2","plone-helpers-1.0.1","plone-providers-1.0.0-alpha.7","plone-registry-2.3.0","plone-client-1.0.0-alpha.22","plone-types-1.3.0","17.20.4","plone-client-1.0.0-alpha.21","18.6.0","plone-slate-18.1.0","18.5.0","18.4.0","17.20.3","17.20.1","plone-components-3.0.1","plone-types-1.2.0","18.3.0","plone-slate-18.0.4","plone-helpers-1.0.0","plone-registry-2.2.0","plone-components-3.0.0","plone-types-1.1.0","17.20.2","18.2.3","18.2.2","18.2.1","plone-slate-18.0.3","18.2.0","plone-slate-18.0.2","18.1.2","plone-components-2.2.1","18.1.1","plone-providers-1.0.0-alpha.6","plone-components-2.2.0","18.1.0","plone-slate-18.0.1","18.0.3","plone-registry-2.1.2","18.0.2","plone-providers-1.0.0-alpha.5","plone-scripts-3.8.1","plone-components-2.1.1","plone-registry-2.1.1","18.0.1","plone-providers-1.0.0-alpha.4","plone-components-2.1.0","plone-client-1.0.0-alpha.20","plone-scripts-3.8.0","plone-registry-2.1.0","generator-volto-9.0.0","18.0.0","plone-slate-18.0.0","17.20.0","17.19.0","17.18.2","17.18.1","17.18.0","17.17.0","17.16.2","17.16.1","17.16.0","17.15.6","17.15.5","17.15.4","generator-volto-8.1.4","17.15.3","17.15.2","generator-volto-8.1.3","17.15.1","17.15.0","17.14.0","17.13.0","17.12.1","generator-volto-8.1.2","17.12.0","17.11.5","17.11.4","17.11.3","17.11.2","17.11.1","17.11.0","17.10.0","17.9.0","17.8.0","generator-volto-8.1.1","17.7.0","generator-volto-8.1.0","17.6.1","17.6.0","17.5.0","17.4.0","17.3.0","17.2.0","17.1.1","17.1.0","plone-scripts-3.0.1","17.0.1","generator-volto-7.0.1","plone-volto-testing-4.0.0","generator-volto-7.0.0","17.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61668.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}