Executive brief
Plone Volto is a headless CMS and content management platform built on Node.js. An unauthenticated attacker can crash the Node.js server by accessing a specific URL, causing service disruption. Automatic process restart capabilities mitigate downtime but do not prevent the crash itself.
Technical details
Volto is vulnerable to a denial-of-service condition in its Node.js server component triggered by accessing a specific URL without authentication. The root cause involves improper error handling (CWE-755) that allows an anonymous user to cause the server process to exit with an unhandled error. The attack requires only network access and no user interaction; no privileges are required. An attacker can repeatedly invoke the vulnerable URL to cause repetitive server crashes and service unavailability. Patches are available for Volto 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha4 and later; users should upgrade to the latest patch release of their respective major version.
Affected products
- Plone Volto before 16.34.0; 17.0.0 before 17.22.1; 18.0.0 before 18.24.0; 19.0.0-alpha.1 before 19.0.0-alpha.4
Timeline
- 2025-08-28: disclosed: Advisory published
- 2025-08-28: patched: Patches released for versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha4