CVE-2025-46721: nosurf vulnerable to CSRF due to non-functional same-origin request checks
(updated )
This vulnerability allows an attacker who controls content on the target site, or on a subdomain of the target site (either via XSS, or otherwise) to bypass Cross-Site Request Forgery checks and issue requests on user’s behalf.
References
- github.com/advisories/GHSA-rq77-p4h8-4crw
- github.com/advisories/GHSA-w9hf-35q4-vcjw
- github.com/justinas/nosurf
- github.com/justinas/nosurf-cve-2025-46721
- github.com/justinas/nosurf/commit/ec9bb776d8e5ba9e906b6eb70428f4e7b009feee
- github.com/justinas/nosurf/releases/tag/v1.2.0
- github.com/justinas/nosurf/security/advisories/GHSA-w9hf-35q4-vcjw
- nvd.nist.gov/vuln/detail/CVE-2025-46721
Code Behaviors & Features
Detect and mitigate CVE-2025-46721 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →