Nosurf Project

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Nosurf Project records in CISA KEV

No Nosurf Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Nosurf 2 records MEDIUM

Records

2 records in Nosurf · all components

TI-2025-29392 CVE-2025-46721 · GHSA-w9hf-35q4-vcjw

nosurf vulnerable to CSRF due to non-functional same-origin request checks

MEDIUM 60

nosurf is cross-site request forgery (CSRF) protection middleware for Go.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00244 Published 2025-05-13 Fixed in 1.2.0 CWE-352

TI-2020-18792 CVE-2020-36564 · GHSA-5x84-q523-vvwr

Improper input validation in github.com/justinas/nosurf

MEDIUM 40

Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00783 Published 2022-12-27 Fixed in 1.1.1 CWE-20

Open these records in search →

Critical	0
High	1
Medium	1
Low	0
No CVSS	0