high8.2
CVE-2025-2691
nossrf Server-Side Request Forgery (SSRF)
Impact
Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | nossrf | < 1.0.4 | 1.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nossrf Project | Nossrf | before 1.0.4 |