nossrf Server-Side Request Forgery (SSRF)

심각 9.1CVE-2025-2691 · GHSA-vm77-mr48-27wj · Published 23/03/2025 · updated 17/06/2026

요약

CVE-2025-2691은(는) nossrf (nossrf project), nossrf에 영향을 주는 심각 (CVSS 9.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.40%, 전체 취약점의 34.3%보다 높음.
조치: 1.0.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
nossrf nossrf_project	`< 1.0.4`	`1.0.4`
nossrf npm	`< 1.0.4`	`1.0.4`

Description

Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.

NVD description

Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.

References

nvd.nist.gov/vuln/detail/CVE-2025-2691 · ADVISORY
security.snyk.io/vuln/SNYK-JS-NOSSRF-9510842 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free