CVE-2025-2691: 
JavaScript vulnerability analysis and mitigation

CVE-2025-2691 affects versions of the package nossrf before 1.0.4, where a Server-Side Request Forgery (SSRF) vulnerability allows attackers to bypass the SSRF protection mechanism by providing a hostname that resolves to a local or reserved IP address space. The vulnerability was discovered and disclosed on March 23, 2025 (Snyk).

The vulnerability has received a CVSS v3.1 base score of 9.1 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, and a CVSS v4.0 score of 8.8 (HIGH). The vulnerability is classified as CWE-918 (Server-Side Request Forgery). The issue allows attackers to bypass SSRF protection by using hostnames that resolve to local or reserved IP addresses (NVD).

The vulnerability allows attackers to bypass SSRF protection mechanisms, potentially leading to unauthorized access to internal resources and services. This could result in significant impact on confidentiality and limited impact on integrity of the affected systems (Snyk).

A proof-of-concept exploit exists and has been publicly disclosed. The vulnerability can be exploited by using hostnames that resolve to local IP addresses (like localtest.me which resolves to 127.0.0.1) to bypass the SSRF protection mechanism (Snyk).

The recommended mitigation is to upgrade the nossrf package to version 1.0.4 or higher, which contains the fix for this vulnerability (Snyk).