Vulnerability Description
Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid. This oversight allows attackers to craft requests targeting these multicast addresses.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Felipperegazio | Ssrf Check | < 1.2.0 |
Related Weaknesses (CWE)
References
- https://gist.github.com/lirantal/2976840639df824cb3abe60d13c65e04ExploitThird Party Advisory
- https://github.com/felippe-regazio/ssrfcheck/commit/9507b49fd764f2a1a1d1e3b9ee57Patch
- https://github.com/felippe-regazio/ssrfcheck/issues/5Issue Tracking
- https://security.snyk.io/vuln/SNYK-JS-SSRFCHECK-9510756ExploitThird Party Advisory
FAQ
What is CVE-2025-8267?
CVE-2025-8267 is a vulnerability with a CVSS score of 8.2 (HIGH). Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the ...
How severe is CVE-2025-8267?
CVE-2025-8267 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-8267?
Check the references section above for vendor advisories and patch information. Affected products include: Felipperegazio Ssrf Check.