CVE-2025-15104 Nu Html Checker (validator.nu) - Restriction bypass vulnerability allowing local SSRF
Attackers can bypass hostname restrictions to force the validator to make requests to internal resources, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15104?
CVE-2025-15104 is a medium-severity server-side request forgery vulnerability in The Nu Html Checker, published on 16 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost services. While the validator implements hostname-based protections to block direct access to localhost and 127.0.0.1, these controls can be bypassed using DNS rebinding techniques or domains that resolve to loopback addresses.This issue affects The Nu Html Checker (vnu): latest (commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd).
Weakness: CWE-918
Which versions are affected by CVE-2025-15104?
4 open source packages ship an affected version, including nu.validator:validator and vnu-jar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nu.validator:validator Maven | All versions to 26.1.11 | None |
nu.validator:validator Maven | All versions to 26.1.11 | None |
vnu-jar npm | All versions to 26.1.11 | None |
vnu-jar npm | All versions to 26.1.11 | None |
Products include Validator Validator.
How do I fix CVE-2025-15104?
No fix has been published for CVE-2025-15104 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-15104 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15104 exists.
Sources
Also known as DEBIAN-CVE-2025-15104, GHSA-fccg-7w3p-w66f, UBUNTU-CVE-2025-15104.