VYPR
← All advisories
High severity8.2NVD Advisory· Published Jul 28, 2025· Updated Apr 29, 2026

CVE-2025-8267

CVE-2025-8267

Description

Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid. This oversight allows attackers to craft requests targeting these multicast addresses.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ssrfchecknpm
< 1.2.01.2.0

Affected products

1

Patches

1
9507b49fd764

added 224.0.0.0/4 as private address - https://gist.github.com/lirantal/2976840639df824cb3abe60d13c65e04

https://github.com/felippe-regazio/ssrfcheckFelippe RegazioJul 13, 2025via ghsa
commit
3 files changed · +3 −2
  • package.json+1 −1 modified
    @@ -1,6 +1,6 @@
 {
   "name": "ssrfcheck",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "Check if a string contains a potential SSRF attack",
   "main": "./src/index.js",
   "repository": {
  • package-lock.json+1 −1 modified
    @@ -1,5 +1,5 @@
 {
   "name": "ssrfcheck",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "lockfileVersion": 1
 }
  • src/is-private-ip.js+1 −0 modified
    @@ -28,6 +28,7 @@ const PRIVATE_CIDRS = [
   '198.18.0.0/15',
   '198.51.100.0/24',
   '203.0.113.0/24',
+  '224.0.0.0/4',
   '240.0.0.0/4',
   '255.255.255.255/32'
 ];

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.