Medusa v2.21.0 Security Update

Today, we released Medusa v2.21.0 to address a security issue in the Store API. We recommend that all users upgrade or apply an applicable patch linked in the release notes.

For applications deployed on Medusa Cloud, we have already introduced additional firewall rules to mitigate this issue. Cloud users should still upgrade or apply an applicable patch to receive the application-level fix, but they are protected against the issue.

What we fixed

An issue in how core Store API routes restricted access to related data could allow clients to retrieve information that was not intended to be exposed through those routes.

In v2.21.0, core Store API routes explicitly define and enforce which fields and relations clients can retrieve. Any requested field or relation outside a route’s allowed list is ignored.

If your storefront requires additional fields or relations, you can extend the route’s allowed list using the Copy to clipboardallowFields middleware. See our documentation for instructions and examples.

Because Store API routes are generally public, review each addition carefully and only allow information intended to be accessible through that route.

After upgrading, test your storefront integrations to confirm that any required custom fields remain available.

What you need to do

Update your application to v2.21.0 or apply the patch corresponding to your version by following the release notes on GitHub.

If you're a Medusa MCP user, you can prompt your AI agent to perform the update for you:

1
Update my Medusa store to v2.21.0