High severity8.2NVD Advisory· Published Mar 23, 2025· Updated Apr 29, 2026
CVE-2025-2691
CVE-2025-2691
Description
Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nossrfnpm | < 1.0.4 | 1.0.4 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- security.snyk.io/vuln/SNYK-JS-NOSSRF-9510842nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-vm77-mr48-27wjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-2691ghsaADVISORY
News mentions
0No linked articles in our index yet.