Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

Description

A CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses.

Recommendation

Update the @strapi/core package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.20.0
• Patched version(s): 5.20.0

References

• GHSA-9329-mxxw-qwf8
• CVE-2025-53092
• CWE-200
• CWE-284
• CWE-364
• CWE-942
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A5
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to brute force guessing of user sensitive data via search patterns - CVE-2022-36079
• Sensitive data exposure in NATS (GHSA-82rf-q3pr-4f6p) - CVE-2020-26149
• Sensitive data exposure in NATS - CVE-2020-26149
• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message - CVE-2025-64758

Tags:

npm

@strapi/core