# Vercel Firewall protects against the SAMLStorm vulnerability

By Steven Van · 2025-03-18

The Firewall mitigates the xml-crypto flaw automatically, but Vercel still advises updating to xml-crypto 6.0.1, 3.2.1 or 2.1.6.

Vercel has added a [Vercel](<https://creatorstoolbox.com/tools/vercel>) Firewall update that [protects against SAMLStorm](<https://workos.com/blog/samlstorm>), a vulnerability in the xml-crypto package (CVE-2025-29774 and CVE-2025-29775). The flaw affects various SAML implementations and could let attackers bypass authentication. Vercel says the Firewall mitigates the risk automatically.

Vercel still recommends updating xml-crypto. Anyone on version 6.0.0 or earlier, or on a package that depends on xml-crypto, should move to a patched release: 6.0.1, 3.2.1 or 2.1.6.

The WorkOS report, which first described the vulnerability, says it also affects Node.js SAML libraries built on xml-crypto, including @node-saml/node-saml, samlify, saml2-js, samlp and saml2-suomifi. Vercel says it will keep monitoring and post updates, and points customers with questions to Vercel Support.

[![](<https://images.workoscdn.com/images/5aafb44e-7b8b-430c-a422-a495d2a01eb0.png?auto=format&fit=clip&q=80>)](<https://workos.com/blog/samlstorm>)

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://workos.com/blog/samlstorm>)

[Read Vercel Firewall protects against the SAMLStorm vulnerability on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-vercel-firewall-protects-against-the-samlstorm-vulnerability>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-vercel-firewall-protects-against-the-samlstorm-vulnerability