CVE-2025-8267: ssrfcheck Package Suffers from Server-Side Request Forgery Vulnerability Due to Incomplete IP Address Deny List
Summary
CVE-2025-8267: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability. Affects ssrfcheck versions < 1.2.0. Fixed in 1.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ssrfcheck package is a Node.js library designed to help developers mitigate Server-Side Request Forgery (SSRF) vulnerabilities in their applications. It provides a mechanism to validate and restrict outgoing requests based on a denylist of IP address ranges. However, prior to version 1.2.0, the package contained an incomplete denylist, which left it vulnerable to exploitation.
Vulnerability Detail
Versions of the ssrfcheck package before 1.2.0 are susceptible to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid. This oversight allows attackers to craft requests targeting these multicast addresses, potentially leading to unauthorized access to internal services or sensitive data.
How To Fix
Minimum fixed version
1.2.0
This is the first release that contains the fix.
npm install ssrfcheck@1.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually filter out requests to the multicast IP address range (224.0.0.0/4) in your application logic until you can update the package. For example, you can implement a check before making requests: if (
ipAddress.startsWith('224.')) { throw new Error('Invalid IP address');
}
Conclusion
The ssrfcheck package has a critical vulnerability that can lead to Server-Side Request Forgery due to an incomplete denylist of IP addresses. It is essential to update to version 1.2.0 or later to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for ssrfcheck →
FAQ
SSRF is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access or data exposure.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can determine if your application is affected. You can also visit the Vulert playground at Vulert Scanner to check without signing up.
Exploitation of this vulnerability could allow attackers to access internal services, retrieve sensitive data, or perform unauthorized actions within your network.
Yes, failing to update the package leaves your application exposed to SSRF attacks, which could compromise your system's security and integrity.
The CVSS score of this vulnerability is 8.2, indicating a high severity level that requires prompt attention.
References
Related vulnerabilities
Recent vulnerabilities recorded for ssrfcheck.
