Description
When visiting a specific URL, an anonymous user could cause the NodeJS server part of Volto to quit with an error.
Recommendation
Update the @plone/volto package to the latest compatible version. Followings are version details:
Affected version(s): **>= 19.0.0-alpha.1, < 19.0.0-alpha.6 >= 18.0.0, < 18.27.2 >= 17.0.0, < 17.22.2 < 16.34.1** Patched version(s): **19.0.0-alpha.6 18.27.2 17.22.2 16.34.1**
References
Could your website be exposed too?
SmartScanner can check your website for @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Volto affected by possible DoS by invoking specific URL by anonymous user - CVE-2025-58047
- auth-js Vulnerable to Insecure Path Routing from Malformed User Input - CVE-2025-48370
- Fiora chat user avatar is vulnerable to XSS via SVG files - CVE-2025-56514
- pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding - CVE-2025-11362
You might also like:
See something that needs correcting? Let us knowUpdated October 03, 2025