CVE-2025-61668

npm/@plone/volto CVE-2025-61668: high

@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user

Action: Upgrade @plone/volto to 16.34.1 or later.

npm i @plone/volto@16.34.1

npm i @plone/volto@17.22.2

npm i @plone/volto@18.27.2

npm i @plone/volto@19.0.0-alpha.6

Affected

Fixed versions

Sources

• osv: GHSA-m8rj-ppph-mj33
• https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33
• https://nvd.nist.gov/vuln/detail/CVE-2025-61668
• https://github.com/plone/volto/pull/7412
• https://github.com/plone/volto/pull/7413
• https://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c
• https://github.com/plone/volto
• https://github.com/plone/volto/releases/tag/16.34.1
• https://github.com/plone/volto/releases/tag/17.22.2
• https://github.com/plone/volto/releases/tag/19.0.0-alpha.6
• http://github.com/plone/volto/releases/tag/18.27.2

CVE-2025-61668 · published 2025-10-01T15:53:43Z · modified 2025-10-03T13:22:42Z · JSON