Vercel Firewall protects against the SAMLStorm vulnerability
By Steven Van ·
The Firewall mitigates the xml-crypto flaw automatically, but Vercel still advises updating to xml-crypto 6.0.1, 3.2.1 or 2.1.6.
Vercel has added a Vercel Firewall update that protects against SAMLStorm, a vulnerability in the xml-crypto package (CVE-2025-29774 and CVE-2025-29775). The flaw affects various SAML implementations and could let attackers bypass authentication. Vercel says the Firewall mitigates the risk automatically.
Vercel still recommends updating xml-crypto. Anyone on version 6.0.0 or earlier, or on a package that depends on xml-crypto, should move to a patched release: 6.0.1, 3.2.1 or 2.1.6.
The WorkOS report, which first described the vulnerability, says it also affects Node.js SAML libraries built on xml-crypto, including @node-saml/node-saml, samlify, saml2-js, samlp and saml2-suomifi. Vercel says it will keep monitoring and post updates, and points customers with questions to Vercel Support.
