CVE-2025-54590: 
JavaScript vulnerability analysis and mitigation

The CVE-2025-54590 vulnerability affects webfinger.js, a TypeScript-based WebFinger client that runs in both browsers and Node.js environments, in versions 2.8.0 and below. The vulnerability was discovered by Ori Hollander of the JFrog Vulnerability Research team and disclosed on July 28, 2025. This is a Blind Server-Side Request Forgery (SSRF) vulnerability that allows attackers to make unauthorized requests to internal networks and localhost services (GitHub Advisory, Debian Tracker).

The vulnerability exists in the lookup function which processes user addresses for account checking. The function fails to properly validate host addresses, allowing access to localhost and LAN addresses (such as 192.168.x.x). The only localhost check performed is for protocol selection (HTTP/HTTPS) and only tests if the host starts with "localhost" and ends with a port. This check can be bypassed using alternative localhost representations like "127.0.0.1" or malformed addresses. Additionally, the host extraction logic allows path injection by accepting any content after the @ symbol in user addresses, enabling access to arbitrary paths beyond the intended "/.well-known/" directory (GitHub Advisory).

The vulnerability allows attackers to cause servers using the library to send GET requests with controlled host, path, and port parameters to query services running on the instance's host or local network. This can be exploited to execute Blind-SSRF attacks targeting vulnerable local services running on the victim's machine. The issue is particularly concerning for ActivityPub applications as it violates the security considerations specified in the ActivityPub specification (GitHub Advisory).

The vulnerability has been fixed in version 2.8.1 of webfinger.js. The fix includes comprehensive SSRF protection that blocks private networks and validates redirects by default. The update implements proper validation of host addresses, prevents access to private IP ranges, and includes DNS resolution protection in Node.js environments to prevent attacks using domains that resolve to private IP addresses (GitHub Release).