# CVE-2020-8123: Strapi denial of service in admin plugin management

Source: https://junglewise.ai/threats/cve-2020-8123-strapi-denial-of-service-in-admin-plugin-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-12-10. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2020-8123 · Severity: low · CVSS 3.1 · Published 2021-12-10

A vulnerability in the Strapi headless content management system allows an administrative user to crash the application. By sending a specially crafted request through the admin console, an attacker can force the service to restart, leading to a denial of service. This disrupts the availability of the CMS for content editors and any connected applications.

Technologies: [@strapi/admin (npm)](https://junglewise.ai/threats/technologies/strapi-admin). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-8123 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-8123 being exploited in the wild.

**How severe is CVE-2020-8123?** Low severity, with a CVSS score of 3.1, published 10 December 2021.

**Which products and versions are affected?** @strapi/admin (npm) SEMVER:introduced=0,fixed=3.0.0-beta.18.4.

**Is there a fix for CVE-2020-8123?** Yes. @strapi/admin (npm): upgrade to 3.0.0-beta.18.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-8123 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-8123?** Check whether you run @strapi/admin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @strapi/admin (npm): upgrade to 3.0.0-beta.18.4 or later

  ```sh
  npm install @strapi/admin@3.0.0-beta.18.4
  ```


## Technical details

An uncontrolled resource consumption vulnerability (CWE-400) exists in the strapi-admin package of Strapi. The flaw is located in the plugin installation/uninstallation controllers where insufficient validation of plugin names allows an authenticated user with administrative privileges to trigger an unhandled exception or resource exhaustion that results in the application restarting. The fix introduced a regular expression validator (PLUGIN_NAME_REGEX) to ensure plugin names conform to expected alphanumeric formats. This issue is resolved in version 3.0.0-beta.18.4.

## Affected products

- Strapi strapi-admin <= 3.0.0-beta.18.3

## Identifiers

- CVE-2020-8123
- GHSA-23fp-fmrv-f5px

## Timeline

- 2020-02-04: advisory: NVD published CVE-2020-8123
- 2021-12-10: disclosed: GHSA-23fp-fmrv-f5px published

## References

- [https://github.com/strapi/strapi/commit/c0c191c08f05fe10d7a6b1bf9475c1a651a89362](https://github.com/strapi/strapi/commit/c0c191c08f05fe10d7a6b1bf9475c1a651a89362)
- [https://hackerone.com/reports/768574](https://hackerone.com/reports/768574)
- [https://github.com/strapi/strapi](https://github.com/strapi/strapi)

## Related threats

- [Strapi insufficient session invalidation during password reset](https://junglewise.ai/threats/cve-2026-22706-strapi-insufficient-session-invalidation-during-password-reset)
- [Strapi server-side request forgery in webhook settings](https://junglewise.ai/threats/cve-2024-52588-strapi-server-side-request-forgery-in-webhook-settings)
- [Strapi rate limit bypass in admin login](https://junglewise.ai/threats/cve-2023-38507-strapi-rate-limit-bypass-in-admin-login)
- [Strapi information disclosure in content-manager relations view](https://junglewise.ai/threats/cve-2023-36472-strapi-information-disclosure-in-content-manager-relations-view)