Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

Description

A CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses.

Recommendation

Update the @strapi/core package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.20.0
• Patched version(s): 5.20.0

References

• GHSA-9329-mxxw-qwf8
• CVE-2025-53092
• CWE-200
• CWE-284
• CWE-364
• CWE-942
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A5
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to brute force guessing of user sensitive data via search patterns - CVE-2022-36079
• Strapi may leak sensitive data via relational filtering due to lack of query sanitization - CVE-2026-27886
• Quill is vulnerable to XSS via HTML export feature - CVE-2025-15056
• Astro vulnerable to reflected XSS via the server islands feature - CVE-2025-64764

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@strapi/core