CVE-2025-15104: 
JavaScript vulnerability analysis and mitigation

CVE-2025-15104 is a Server-Side Request Forgery (SSRF) vulnerability in the Nu Html Checker (validator.nu / vnu) that allows unauthenticated remote attackers to bypass hostname-based protections and force the server to make arbitrary HTTP/HTTPS requests to internal resources, including localhost services. The vulnerability was discovered by Fluid Attacks (credited to researcher augustocesarperin) and published on January 16, 2026, affecting all versions up to and including 26.1.11 (commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd). It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, NVD).

The root cause is classified as CWE-918 (Server-Side Request Forgery), arising from insufficient validation of user-supplied URLs submitted to the vnu checker service. While the validator implements hostname-based controls to block direct access to localhost and 127.0.0.1, these protections can be circumvented via DNS rebinding attacks or by using domains that resolve to loopback addresses — effectively tricking the server into making requests to internal network resources on behalf of the attacker. The attack requires no authentication, no user interaction, and can be executed remotely over the network with low complexity. A proof-of-concept exploit is publicly available via Fluid Attacks (Fluid Attacks Advisory, GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to probe internal networks and access localhost services that are otherwise protected by network segmentation, potentially exposing sensitive data from internal APIs, metadata services, or administrative interfaces. The primary impact is on confidentiality of subsequent/internal systems, with no direct integrity or availability impact on the vulnerable system itself. In cloud environments, this could enable access to instance metadata endpoints (e.g., AWS IMDSv1), facilitating credential theft and lateral movement (Fluid Attacks Advisory, GitHub Advisory).

A proof-of-concept exploit is publicly available via Fluid Attacks' advisory page. There is no confirmed evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.063% (0.029% per GitHub Advisory), placing it in a low exploitation probability tier. No specific threat actor attribution has been reported (Fluid Attacks Advisory, GitHub Advisory).

1. Reconnaissance: Identify publicly accessible instances of the Nu Html Checker (vnu) service, typically running on port 8888, using tools like Shodan or Censys. Target instances running versions ≤ 26.1.11.
2. Set up DNS rebinding infrastructure: Register a domain and configure a DNS server to initially resolve to an attacker-controlled IP, then rapidly re-resolve to a loopback address (e.g., 127.0.0.1) after the initial hostname check passes.
3. Craft malicious validation request: Submit an HTML document or URL to the vnu checker's REST API (e.g., POST / or via the ?doc= parameter) that references the attacker-controlled domain, which will subsequently resolve to an internal address.
4. Trigger SSRF: The vnu checker performs its hostname validation against the initial (non-loopback) DNS response, passes the check, then makes the HTTP request after DNS rebinding has occurred — causing the server to fetch content from an internal resource (e.g., http://localhost:8080/admin or http://169.254.169.254/latest/meta-data/).
5. Exfiltrate data: Retrieve the response from the internal resource via the validator's error output or response body, potentially exposing credentials, configuration data, or internal service content (Fluid Attacks Advisory, GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the vnu checker service to internal IP ranges (RFC 1918) or loopback addresses (127.0.0.1, ::1); DNS queries from the vnu host to unusual or newly registered external domains followed by rapid re-resolution.
• Logs: vnu service access logs showing repeated validation requests referencing external domains that resolve to internal addresses; HTTP requests to cloud metadata endpoints (e.g., 169.254.169.254) originating from the vnu process.
• Process: Unusual outbound network connections initiated by the Java process running vnu to internal services (e.g., databases, admin panels, metadata services) that would not normally be accessed by the validator.

Update the Nu Html Checker (vnu) to a version released on or after January 11, 2026 (post-commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd), as the vulnerability affects all versions ≤ 26.1.11 for both the Maven (nu.validator:validator) and npm (vnu-jar) packages. If immediate patching is not possible, restrict network access to the vnu service to trusted internal networks only using firewall rules, and block outbound connections from the vnu service to internal IP ranges and loopback addresses at the network level. Additionally, monitor validation requests for suspicious URL patterns targeting internal or loopback addresses (GitHub Advisory, Fluid Attacks Advisory).

The vulnerability was discovered and reported by Fluid Attacks researcher augustocesarperin, with the advisory published on January 16, 2026. Red Hat has acknowledged the CVE and published a security advisory. The vulnerability received moderate community attention, with mentions on Bluesky and aggregation by multiple vulnerability tracking platforms. No major media coverage or significant public researcher commentary beyond the initial disclosure has been identified (Red Hat CVE, GitHub Advisory).