nosurf is cross-site request forgery (CSRF) protection middleware for Go. A vulnerability in versions prior to 1.2.0 allows an attacker who controls content on the target site, or on a subdomain of the target site (either via XSS, or otherwise) to bypass CSRF checks and issue requests on user's behalf. Due to misuse of the Go `net/http` library, nosurf categorizes all incoming requests as plain-text HTTP requests, in which case the `Referer` header is not checked to have the same origin as the target webpage. If the attacker has control over HTML contents on either the target website (e.g. `example.com`), or on a website hosted on a subdomain of the target (e.g. `attacker.example.com`), they will also be able to manipulate cookies set for the target website. By acquiring the secret CSRF token from the cookie, or overriding the cookie with a new token known to the attacker, `attacker.example.com` is able to craft cross-site requests to `example.com`. A patch for the issue was released in nosurf 1.2.0. In lieu of upgrading to a patched version of nosurf, users may additionally use another HTTP middleware to ensure that a non-safe HTTP request is coming from the same origin (e.g. by requiring a `Sec-Fetch-Site: same-origin` header in the request).
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Nosurf Project |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-14655 | nosurf vulnerable to CSRF due to non-functional same-origin request checks |
 Github GHSA |
GHSA-w9hf-35q4-vcjw | nosurf vulnerable to CSRF due to non-functional same-origin request checks |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 23 Jun 2025 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Nosurf Project
Nosurf Project nosurf |
|
| CPEs | cpe:2.3:a:nosurf_project:nosurf:*:*:*:*:*:go:*:* | |
| Vendors & Products |
Nosurf Project
Nosurf Project nosurf |
|
| Metrics |
cvssV3_1
|
Tue, 13 May 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 13 May 2025 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | nosurf is cross-site request forgery (CSRF) protection middleware for Go. A vulnerability in versions prior to 1.2.0 allows an attacker who controls content on the target site, or on a subdomain of the target site (either via XSS, or otherwise) to bypass CSRF checks and issue requests on user's behalf. Due to misuse of the Go `net/http` library, nosurf categorizes all incoming requests as plain-text HTTP requests, in which case the `Referer` header is not checked to have the same origin as the target webpage. If the attacker has control over HTML contents on either the target website (e.g. `example.com`), or on a website hosted on a subdomain of the target (e.g. `attacker.example.com`), they will also be able to manipulate cookies set for the target website. By acquiring the secret CSRF token from the cookie, or overriding the cookie with a new token known to the attacker, `attacker.example.com` is able to craft cross-site requests to `example.com`. A patch for the issue was released in nosurf 1.2.0. In lieu of upgrading to a patched version of nosurf, users may additionally use another HTTP middleware to ensure that a non-safe HTTP request is coming from the same origin (e.g. by requiring a `Sec-Fetch-Site: same-origin` header in the request). | |
| Title | nosurf vulnerable to CSRF due to non-functional same-origin request checks | |
| Weaknesses | CWE-352 | |
| References |
|
|
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-05-13T19:07:23.093Z
Reserved: 2025-04-28T20:56:09.084Z
Link: CVE-2025-46721
Vulnrichment
Updated: 2025-05-13T19:07:11.685Z
NVD
Status : Analyzed
Published: 2025-05-13T16:15:31.750
Modified: 2025-06-23T14:55:07.967
Link: CVE-2025-46721
Redhat
No data.
OpenCVE Enrichment
No data.