CVE-2025-54590 webfinger.js is vulnerable to Blind SSRF attacks through localhost
Attackers can exploit insufficient localhost validation in webfinger.js to perform blind SSRF attacks, accessing internal services on the host or local network.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54590?
CVE-2025-54590 is a medium-severity server-side request forgery vulnerability in silverbucket webfinger.js, published on 1 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accepts user addresses for account checking. However, the ActivityPub specification requires preventing access to localhost services in production. This library does not prevent localhost access, only checking for hosts that start with "localhost" and end with a port. Users can exploit this by creating servers that send GET requests with controlled host, path, and port parameters to query services on the instance's host or local network, enabling blind SSRF attacks. This is fixed in version 2.8.1.
Weakness: CWE-918
Which versions are affected by CVE-2025-54590?
2 open source packages ship an affected version, including webfinger.js.
| Package | Affected | Fixed in |
|---|---|---|
webfinger.js npm | All versions | 2.8.1 |
webfinger.js npm | All versions | 2.8.1 |
How do I fix CVE-2025-54590?
Upgrade webfinger.js to 2.8.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-54590 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54590 exists.
Sources
Also known as GHSA-8xq3-w9fx-74rv.