CVE-2025-46721 nosurf vulnerable to CSRF due to non-functional same-origin request checks
An attacker with control over site content or subdomains can bypass CSRF protections in the nosurf Go library to perform actions on behalf of users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-46721?
CVE-2025-46721 is a medium-severity vulnerability in justinas nosurf, published on 13 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
nosurf is cross-site request forgery (CSRF) protection middleware for Go. A vulnerability in versions prior to 1.2.0 allows an attacker who controls content on the target site, or on a subdomain of the target site (either via XSS, or otherwise) to bypass CSRF checks and issue requests on user's behalf. Due to misuse of the Go `net/http` library, nosurf categorizes all incoming requests as plain-text HTTP requests, in which case the `Referer` header is not checked to have the same origin as the target webpage. If the attacker has control over HTML contents on either the target website (e.g. `example.com`), or on a website hosted on a subdomain of the target (e.g. `attacker.example.com`), they will also be able to manipulate cookies set for the target website. By acquiring the secret CSRF token from the cookie, or overriding the cookie with a new token known to the attacker, `attacker.example.com` is able to craft cross-site requests to `example.com`. A patch for the issue was released in nosurf 1.2.0. In lieu of upgrading to a patched version of nosurf, users may additionally use another HTTP middleware to ensure that a non-safe HTTP request is coming from the same origin (e.g. by requiring a `Sec-Fetch-Site: same-origin` header in the request).
Weakness: CWE-352
Which versions are affected by CVE-2025-46721?
3 open source packages ship an affected version, including github.com/justinas/nosurf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/justinas/nosurf Go | All versions | 1.2.0 |
github.com/justinas/nosurf Go | All versions | 1.2.0 |
github.com/justinas/nosurf Go | All versions | 1.2.0 |
Products include Nosurf Project Nosurf.
How do I fix CVE-2025-46721?
Upgrade github.com/justinas/nosurf to 1.2.0 or later.
Is CVE-2025-46721 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46721 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in justinas nosurf
Sources
Also known as GHSA-w9hf-35q4-vcjw, GO-2025-3683.