CVE-2025-58047: @plone/volto Denial of Service Vulnerability
HIGHCVE-2025-58047 is a HIGH (CVSS 7.5) denial of service vulnerability (CWE-755: Improper Handling of Exceptional Conditions) affecting @plone/volto libraries in the npm ecosystem. The issue involves volto affected by possible dos by invoking specific url by anonymous user. Remediation is available by upgrading affected packages to version 16.34.0, 17.22.1, 18.24.0, 19.0.0-alpha.4.
CVE-2025-58047 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2025-58047
To remediate this vulnerability, upgrade all affected @plone/volto dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @plone/volto@16.34.0npm install @plone/volto@17.22.1npm install @plone/volto@18.24.0npm install @plone/volto@19.0.0-alpha.4Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @plone/voltoHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2025-58047, inspect your project dependencies using npm:
npm ls @plone/voltoAnalyze the terminal output to locate any version of @plone/volto in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 16.34.0), your application is affected.
Note: The npm ls @plone/volto command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-755: Improper Handling of Exceptional Conditions, where the product does not handle or incorrectly handles an exceptional condition. In @plone/volto, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-58047 Affected @plone/volto Versions
4 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@plone/volto
|
npm |
< 16.34.0
|
16.34.0
|
|
@plone/volto
|
npm |
≥ 17.0.0
< 17.22.1
|
17.22.1
|
|
@plone/volto
|
npm |
≥ 18.0.0
< 18.24.0
|
18.24.0
|
|
@plone/volto
|
npm |
≥ 19.0.0-alpha.1
< 19.0.0-alpha.4
|
19.0.0-alpha.4
|
References
Frequently Asked Questions
What is CVE-2025-58047?
Which @plone/volto versions are affected?
What version fixes CVE-2025-58047?
Is @plone/volto affected?
What is the CVSS score of CVE-2025-58047?
What CWE is associated with CVE-2025-58047?
How can I check npm dependencies for CVE-2025-58047?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-xjhf-7833-3pm5",
"modified" : "2025-11-05T20:41:12Z",
"published" : "2025-08-28T15:34:28Z",
"aliases" : [ "CVE-2025-58047" ],
"summary" : "Volto affected by possible DoS by invoking specific URL by anonymous user",
"details" : "### Impact\nWhen visiting a specific URL, an anonymous user could cause the NodeJS server part of Volto to quit with an error.\n\n### Patches\nThe problem has been patched and the patch has been backported to Volto major versions down until 16. It is advised to upgrade to the latest patch release of your respective current major version:\n\n- Volto 16: [16.34.0](https://github.com/plone/volto/releases/tag/16.34.0)\n- Volto 17: [17.22.1](https://github.com/plone/volto/releases/tag/17.22.1)\n- Volto 18: [18.24.0](https://github.com/plone/volto/releases/tag/18.24.0)\n- Volto 19: [19.0.0-alpha4](https://github.com/plone/volto/releases/tag/19.0.0-alpha.4)\n\n### Workarounds\nMake sure your setup automatically restarts processes that quit with an error. This won't prevent a crash, but it minimises downtime.\n\n### Report\nThe problem was discovered by FHNW, a client of Plone provider kitconcept, who shared it with the Plone Zope Security Team (security@plone.org).",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@plone/volto"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "16.34.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@plone/volto"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "17.0.0"
}, {
"fixed" : "17.22.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@plone/volto"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "18.0.0"
}, {
"fixed" : "18.24.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@plone/volto"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "19.0.0-alpha.1"
}, {
"fixed" : "19.0.0-alpha.4"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/plone/volto/security/advisories/GHSA-xjhf-7833-3pm5"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-58047"
}, {
"type" : "WEB",
"url" : "https://github.com/plone/volto/commit/2789a287ac45ad9039fb9161d465ba13241fff0a"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/plone/volto"
}, {
"type" : "WEB",
"url" : "https://github.com/plone/volto/releases/tag/16.34.0"
}, {
"type" : "WEB",
"url" : "https://github.com/plone/volto/releases/tag/17.22.1"
}, {
"type" : "WEB",
"url" : "https://github.com/plone/volto/releases/tag/18.24.0"
}, {
"type" : "WEB",
"url" : "https://github.com/plone/volto/releases/tag/19.0.0-alpha.4"
}, {
"type" : "WEB",
"url" : "http://www.openwall.com/lists/oss-security/2025/08/28/3"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-755" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-08-28T15:34:28Z",
"nvd_published_at" : "2025-08-28T18:15:33Z"
}
}