CVE-2025-53092: Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

October 16, 2025 (updated January 29, 2026)

A CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses.

References

github.com/advisories/GHSA-9329-mxxw-qwf8
github.com/strapi/strapi
github.com/strapi/strapi/commit/6e535cb756
github.com/strapi/strapi/releases/tag/v5.20.0
github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8
nvd.nist.gov/vuln/detail/CVE-2025-53092

Code Behaviors & Features

Detect and mitigate CVE-2025-53092 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →