PLACK::MIDDLEWARE::CSP · CVE-2026-125729 · Package
NO FIX YET · SEE WHAT TO DO
Plack::Middleware::CSP before 0.03 for Perl writes the Content Security Policy into a header named content-security-protocol instead of Content-Security-Policy. Browsers ignore that header, so any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications written in Perl that use Plack::Middleware::CSP to set a Content Security Policy. The policy is silently not sent, so the application has no CSP protection against cross-site scripting even though the configuration appears to be in place. Applications that do not use this middleware are not affected.
Not affected if not-using-plack-csp, version-0.03-or-later
Who cares perl, plack, web-apps
perl -MPlack::Middleware::CSP -e 'print $Plack::Middleware::CSP::VERSION'0.03 or later (per the advisory, versions before 0.03 are affected)Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it.
The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header.
Any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.