Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-w9hf-35q4-vcjw
No affected components available
Impact
This vulnerability allows an attacker who controls content on the target site, or on a subdomain of the target site (either via XSS, or otherwise) to bypass Cross-Site Request Forgery checks and issue requests on user's behalf.
Details
Due to misuse of the Go net/http library, nosurf categorizes all incoming requests as plain-text HTTP requests, in which case the Referer header is not checked to have the same origin as the target webpage.
If the attacker has control over HTML contents on either the target website (e.g. example.com), or on a website hosted on a subdomain of the target (e.g. attacker.example.com), they will also be able to manipulate cookies set for the target website. By acquiring the secret CSRF token from the cookie, or overriding the cookie with a new token known to the attacker, attacker.example.com is able to craft cross-site requests to example.com.
Patches
A patch for the issue was released in nosurf 1.2.0.
Workarounds
In lieu of upgrading to a patched version of nosurf, users may additionally use another HTTP middleware to ensure that a non-safe HTTP request is coming from the same origin (e.g. by requiring a Sec-Fetch-Site: same-origin header in the request).
References
https://github.com/advisories/GHSA-rq77-p4h8-4crw https://github.com/justinas/nosurf-cve-2025-46721 https://www.cve.org/CVERecord?id=CVE-2025-46721 https://github.com/justinas/nosurf/releases/tag/v1.2.0
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights.
Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard