Skip to content
OpenAdvisories

Package · npm

@strapi/core

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-53092

    Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

    Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Or…

    strapi strapi @strapi/core npm
  • Medium 6.3
    CVE-2025-25298

    Missing Maximum Password Length Validation in Strapi Password Hashing

    Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently tru…

    strapi strapi @strapi/core npm