Quick answers
- Is CVE-2025-61668 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-61668 being exploited in the wild.
- How severe is CVE-2025-61668?
- Medium severity, with a CVSS score of 4, published 1 October 2025.
- Which products and versions are affected?
- Plone Volto <16.34.1, 17.0.0 to <17.22.2, 18.0.0 to <18.27.2, 19.0.0-alpha.1 to <19.0.0-alpha.6.
- Is there a fix for CVE-2025-61668?
- A patch was published on 2025-10-01: Patches released for versions 16.34.1, 17.22.2, 18.27.2, 19.0.0-alpha.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-61668 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-61668?
- Check whether you run Plone Volto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the Volto Node.js server that can be triggered by accessing a specific URL without authentication. An anonymous user can cause the server process to quit with an error by invoking this URL, resulting in denial of service. The attack requires no privileges, authentication, or user interaction—only network reachability to the Volto server. Patches have been released and backported to versions 16.34.1, 17.22.2, 18.27.2, and 19.0.0-alpha.6. Affected installations should upgrade immediately; a temporary workaround is to configure automatic process restart to minimize downtime.
Affected products
- Plone Volto <16.34.1, 17.0.0 to <17.22.2, 18.0.0 to <18.27.2, 19.0.0-alpha.1 to <19.0.0-alpha.6
Identifiers
- CVE-2025-61668
- GHSA-m8rj-ppph-mj33
Timeline
- 2025-10-01: disclosed: GHSA-m8rj-ppph-mj33 published
- 2025-10-01: patched: Patches released for versions 16.34.1, 17.22.2, 18.27.2, 19.0.0-alpha.6