CVE-2025-9960
is-localhost-ip 2.0.0
- Class
- SSRF
- Severity
- Medium · CVSS 4.0 score 6.9
- Disclosed
- Credit
- Cristian Vargas, Fluid Attacks Offensive Team
- Code name
- registrada
- Affected
- is-localhost-ip 2.0.0
The defect
SSRF via restrictions bypass
Class overview · SSRF
The server is asked to fetch a URL the attacker chooses. The request comes from inside the service's own network position, reaching things the attacker cannot reach directly: internal endpoints, cloud metadata or unauthenticated services.