GitHub Advisoryadvisory · npm

GHSA-vm77-mr48-27wj nossrf Server-Side Request Forgery (SSRF)

HIGH Published 2025-03-23 Modified 2025-09-26 Official page ↗
Aliases
CVE-2025-2691
Ecosystem
npm
Packages
nossrf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-918
Reviewed
2025-03-25

Affected packages

• npm nossrf: < 1.0.4 → fixed in 1.0.4

Description

Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.

Related

Alias · CVE (1)

  • CVE-2025-2691 Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References