Improper input validation in github.com/justinas/nosurf
Priority MEDIUM 40CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00783 56th percentileScored 2026-11-07
Fix Fixed github.com/justinas/nosurf (github.com/justinas/nosurf): 1.1.1github.com/justinas/nosurf (Go): 1.1.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| github.com/justinas/nosurf | github.com/justinas/nosurf | before 1.1.1 | 1.1.1 | Patch available | CNA |
| — | github.com/justinas/nosurf (Go) | before 1.1.1 | 1.1.1 | Patch available | GHSA-5x84-q523-vvwr |
- github.com/justinas/nosurf Vendorgithub.com/justinas/nosurf Affected before 1.1.1 Fixed in 1.1.1 Patch available CNA
- github.com/justinas/nosurf (Go) Vendor— Affected before 1.1.1 Fixed in 1.1.1 Patch available GHSA-5x84-q523-vvwr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nosurf_project:nosurf:*:*:*:*:*:go:*:* | before 1.1.1 | Vulnerable | Nosurf Project |
- cpe:2.3:a:nosurf_project:nosurf:*:*:*:*:*:go:*:* Versions before 1.1.1 Vulnerable ·Nosurf Project
Remediation
- Fix · CNA github.com/justinas/nosurf (github.com/justinas/nosurf) Fixed in 1.1.1
- Fix · GHSA-5x84-q523-vvwr github.com/justinas/nosurf (Go) Fixed in 1.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36564
- 2026-10-03 Alias added: GHSA-5x84-q523-vvwr
References
More Nosurf Project Nosurf vulnerabilities
- TI-2025-29392 nosurf vulnerable to CSRF due to non-functional same-origin request checks CVSS 4.0MEDIUM 6.0
Sources
- CVE-2020-36564 · CVE Program
- CVE-2020-36564 · NVD
- FIRST EPSS
- GHSA-5x84-q523-vvwr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences