Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6.

The version of the @plone/volto Node.js Package installed on the remote host is prior to 16.34.1, or 17.x prior to 17.22.2, or 18.x prior to 18.27.2, or 19.0.0-alpha.1 prior to 19.0.0-alpha.6. It is, therefore, affected by a denial of service vulnerability. An unauthenticated, remote attacker, can exploit this issue, via a specific URL, to cause the NodeJS server part of Volto to stop responding.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below,
    17.0.0 through 17.22.1, 18.0.0 through 18.27.1, and 19.0.0-alpha.1 through 19.0.0-alpha.5, an anonymous
    user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. This
    issue is fixed in versions 16.34.1, 17.22.2, 18.27.2 and 19.0.0-alpha.6. (CVE-2025-61668)

ID	Name	Product	Family	Severity
329032	Plone Volto < 16.34.1 / 17.x < 17.22.2 / 18.x < 18.27.2 / 19.0.0-alpha.1 < 19.0.0-alpha.6 DoS	Nessus	Misc.	high
435481	SCA: security update for @plone/volto (GHSA-m8rj-ppph-mj33)	Tenable Cloud Security	SCA Checks	high
435481	SCA: security update for @plone/volto (GHSA-m8rj-ppph-mj33)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-61668

high

Tenable Plugins

high

high

high