Configuration Override in helmet-csp

Description

Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application’s Content Security Policy (CSP). The package’s browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy.

Recommendation

Update the helmet-csp package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.2.2, < 2.9.1
• Patched version(s): 2.9.1

References

• GHSA-c3m8-x3cg-qm2c
• www.npmjs.com
• snyk.io

Related Issues

• tRPC 11 WebSocket DoS Vulnerability - CVE-2025-43855
• DocsGPT Allows Remote Code Execution - CVE-2025-0868
• Signature Malleabillity in elliptic - CVE-2020-13822
• Joplin Vulnerable to Code Injection - CVE-2022-23340

Tags:

npm

helmet-csp