Skip to content
OpenAdvisories

Package · Go

github.com/justinas/nosurf

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.0
    CVE-2025-46721 Public exploit

    nosurf vulnerable to CSRF due to non-functional same-origin request checks

    nosurf is cross-site request forgery (CSRF) protection middleware for Go. A vulnerability in versions prior to 1.2.0 allows an attacker who controls content on the target site, or on a subdomain of the target site (either via XSS, or otherwise) to bypass CSRF…

    justinas nosurf github.com/justinas/nosurf Go
  • High 7.5
    CVE-2020-36564

    Improper input validation in github.com/justinas/nosurf

    Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.

    github.com/justinas/nosurf github.com/justinas/nosurf github.com/justinas/nosurf Go