{"action":"Upgrade @plone/volto to 16.34.1 or later.","affected":[{"fixed":"16.34.1","introduced":"0"},{"fixed":"17.22.2","introduced":"17.0.0"},{"fixed":"18.27.2","introduced":"18.0.0"},{"fixed":"19.0.0-alpha.6","introduced":"19.0.0-alpha.1"}],"component":"@plone/volto","cve_ids":["CVE-2025-61668"],"ecosystem":"npm","epss":0.00437,"exploited":false,"fixed_versions":["16.34.1","17.22.2","18.27.2","19.0.0-alpha.6"],"ghsa_id":"GHSA-m8rj-ppph-mj33","id":"tcs_01M5KG06WM08MHGTFKNYMBSXGQ","modified_at":"2025-10-03T13:22:42Z","published_at":"2025-10-01T15:53:43Z","references":["https://osv.dev/vulnerability/GHSA-m8rj-ppph-mj33","https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33","https://nvd.nist.gov/vuln/detail/CVE-2025-61668","https://github.com/plone/volto/pull/7412","https://github.com/plone/volto/pull/7413","https://github.com/plone/volto/commit/58d9f82d2d50ca9a87edbe16fed91762e57c109c","https://github.com/plone/volto","https://github.com/plone/volto/releases/tag/16.34.1","https://github.com/plone/volto/releases/tag/17.22.2","https://github.com/plone/volto/releases/tag/19.0.0-alpha.6","http://github.com/plone/volto/releases/tag/18.27.2"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-m8rj-ppph-mj33","url":"https://osv.dev/vulnerability/GHSA-m8rj-ppph-mj33"},{"source":"nvd","source_id":"CVE-2025-61668","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61668"}],"summary":"@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user"}