# CVE-2025-61668: Plone Volto denial of service via specific URL

Source: https://junglewise.ai/threats/cve-2025-61668-plone-volto-denial-of-service-via-specific-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-61668 · Severity: medium · CVSS 4 · Published 2025-10-01

Plone Volto is a headless CMS frontend framework built on Node.js that serves web content. An unauthenticated attacker can crash the Volto Node.js server by accessing a specific URL, causing service unavailability. While patches are available for all supported versions, unpatched instances are susceptible to repeated crashes that disrupt service availability.

Technologies: [Plone Volto](https://junglewise.ai/threats/technologies/volto). Vendors: [Plone](https://junglewise.ai/threats/vendors/plone).

## Quick answers

**Is CVE-2025-61668 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61668 being exploited in the wild.

**How severe is CVE-2025-61668?** Medium severity, with a CVSS score of 4, published 1 October 2025.

**Which products and versions are affected?** Plone Volto <16.34.1, 17.0.0 to <17.22.2, 18.0.0 to <18.27.2, 19.0.0-alpha.1 to <19.0.0-alpha.6.

**Is there a fix for CVE-2025-61668?** A patch was published on 2025-10-01: Patches released for versions 16.34.1, 17.22.2, 18.27.2, 19.0.0-alpha.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61668 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-61668?** Check whether you run Plone Volto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a null pointer dereference (CWE-476) in the Volto Node.js server that can be triggered by accessing a specific URL without authentication. An anonymous user can cause the server process to quit with an error by invoking this URL, resulting in denial of service. The attack requires no privileges, authentication, or user interaction—only network reachability to the Volto server. Patches have been released and backported to versions 16.34.1, 17.22.2, 18.27.2, and 19.0.0-alpha.6. Affected installations should upgrade immediately; a temporary workaround is to configure automatic process restart to minimize downtime.

## Affected products

- Plone Volto <16.34.1, 17.0.0 to <17.22.2, 18.0.0 to <18.27.2, 19.0.0-alpha.1 to <19.0.0-alpha.6

## Identifiers

- CVE-2025-61668
- GHSA-m8rj-ppph-mj33

## Timeline

- 2025-10-01: disclosed: GHSA-m8rj-ppph-mj33 published
- 2025-10-01: patched: Patches released for versions 16.34.1, 17.22.2, 18.27.2, 19.0.0-alpha.6

## References

- [https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33](https://github.com/plone/volto/security/advisories/GHSA-m8rj-ppph-mj33)

## Related threats

- [Plone Volto denial-of-service by specific URL](https://junglewise.ai/threats/cve-2025-58047-plone-volto-denial-of-service-by-specific-url)
- [Plone Volto auth token swap due to outdated react-cookie](https://junglewise.ai/threats/cve-2022-24740-plone-volto-auth-token-swap-due-to-outdated-react-cookie)