CVE-2025-61668: @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user

The vulnerability is a classic null pointer dereference within the error handling logic of an API middleware in a Node.js application. The provided patch 58d9f82d2d50ca9a87edbe16fed91762e57c109c clearly shows the fix. The original code error.response.body.message assumes that error.response and error.response.body will always be present in the error object. However, a specially crafted request can cause an API error where this is not the case. The patch introduces optional chaining (?.) to safely access the nested message property, preventing the server from crashing if parts of the error object are missing. This indicates that the apiMiddlewareFactory function is the source of the vulnerability, as it creates the middleware responsible for handling API requests and their potential errors. An attacker could exploit this by sending a request that they know will cause an error in a way that the middleware doesn't expect, leading to a server crash and a denial of service.