Description
When visiting a specific URL, an anonymous user could cause the NodeJS server part of Volto to quit with an error.
Recommendation
Update the @plone/volto package to the latest compatible version. Followings are version details:
Affected version(s): **>= 19.0.0-alpha.1, < 19.0.0-alpha.4 >= 18.0.0, < 18.24.0 >= 17.0.0, < 17.22.1 < 16.34.0** Patched version(s): **19.0.0-alpha.4 18.24.0 17.22.1 16.34.0**
References
Could your website be exposed too?
SmartScanner can check your website for Volto affected by possible DoS by invoking specific URL by anonymous user and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user - CVE-2025-61668
- Sudden swap of user auth tokens in Volto - CVE-2022-24740
- axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - CVE-2025-27152
- Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers - CVE-2025-31137
You might also like:
See something that needs correcting? Let us knowUpdated November 05, 2025