Skip to content
OpenAdvisories

Package · npm

@strapi/core

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.5
    CVE-2025-53092

    Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

    Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Or…

    strapi strapi @strapi/core npm
  • Medium 6.3
    CVE-2025-25298

    Missing Maximum Password Length Validation in Strapi Password Hashing

    Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently tru…

    strapi strapi @strapi/core npm
  • High 8.2
    CVE-2024-56143

    Strapi Allows Unauthorized Access to Private Fields via parms.lookup

    Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, in…

    strapi strapi @strapi/core npm