~ / search / GHSA-vm77-mr48-27wj

GHSA-vm77-mr48-27wj

nossrf Server-Side Request Forgery (SSRF)

Source: GitHub Advisory Database (reviewed) High CVE-2025-2691

Packages

EcosystemPackageAffectedFixed in
npm nossrf < 1.0.4 1.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.

References

External links from the advisory. They lead to third-party sites.