CVE-2025-58047 Volto affected by possible DoS by invoking specific URL by anonymous user
An anonymous user can crash the Volto NodeJS server by visiting a specific URL, causing a denial of service for the Plone CMS frontend.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-58047?
CVE-2025-58047 is a high-severity denial of service vulnerability in plone volto, published on 28 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. The problem has been patched in versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha.4. To mitigate downtime, have setup automatically restart processes that quit with an error.
Weakness: CWE-755
Which versions are affected by CVE-2025-58047?
8 open source packages ship an affected version, including @plone/volto.
| Package | Affected | Fixed in |
|---|---|---|
@plone/volto npm | All versions | 16.34.0 |
@plone/volto npm | All versions | 16.34.0 |
@plone/volto npm | From 17.0.0 | 17.22.1 |
@plone/volto npm | From 17.0.0 | 17.22.1 |
@plone/volto npm | From 18.0.0 | 18.24.0 |
@plone/volto npm | From 18.0.0 | 18.24.0 |
2 more packages
@plone/volto npm | From 19.0.0-alpha.1 | 19.0.0-alpha.4 |
@plone/volto npm | From 19.0.0-alpha.1 | 19.0.0-alpha.4 |
How do I fix CVE-2025-58047?
Upgrade @plone/volto to a fixed version for your release line: 16.34.0, 17.22.1, 18.24.0 or 19.0.0-alpha.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-58047 being exploited?
There is no known exploitation of CVE-2025-58047 in the wild and no public exploit code.
Sources
Also known as GHSA-xjhf-7833-3pm5.