Blind SSRF Vulnerability in webfinger.js: A Risk to Localhost Services
Summary
CVE-2025-54590: webfinger.js Blind SSRF Vulnerability. Affects webfinger.js versions < 2.8.1. Fixed in 2.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
webfinger.js is an npm package designed to facilitate WebFinger lookups, which are used to discover information about users based on their addresses. The package is utilized in ActivityPub applications to enhance user interactions. However, it has a significant vulnerability that allows unauthorized access to localhost and LAN services, posing a risk to production environments.
Vulnerability Detail
The vulnerability arises from the lookup function in webfinger.js, which fails to adequately restrict access to localhost and LAN addresses. According to the ActivityPub specification, access to these services should be prevented in production. The function only checks for 'localhost' in a limited manner, allowing crafted user addresses to bypass this check. An attacker can exploit this to send GET requests to sensitive internal services, potentially leading to data exposure or manipulation.
How To Fix
Minimum fixed version
2.8.1
This is the first release that contains the fix.
npm install webfinger.js@2.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using webfinger.js in production environments until the package is updated. Additionally, implement network-level restrictions to prevent access to localhost and LAN addresses from external sources.
Conclusion
The Blind SSRF vulnerability in webfinger.js poses a significant risk to applications using this package in production. It is crucial to update to the patched version (2.8.1) to mitigate this risk. Additionally, employing network restrictions and utilizing tools like Vulert can help monitor and protect your application from such vulnerabilities.
See every vulnerability recorded for webfinger.js →
FAQ
The vulnerability is a Blind SSRF (Server-Side Request Forgery) that allows attackers to access internal services by crafting specific user addresses.
If your application uses webfinger.js without the patch, it may expose sensitive internal services to unauthorized access, leading to potential data breaches.
Implement network restrictions to block access to localhost and LAN addresses, and monitor your application for any suspicious activity.
Yes, you can use Vulert to monitor your application for vulnerabilities. By analyzing your package-lock.json file, Vulert can alert you to any open-source vulnerabilities in real-time.
You can find detailed information about this vulnerability in the GitHub advisory database or by visiting the Vulert website.
