CVE-2025-11864: NucleoidAI Nucleoid Outbound Request cluster.ts extension.apply server-side request forgery

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-16 · updated 2026-10-09
Weakness: CWE-918

Description

A vulnerability was identified in NucleoidAI Nucleoid up to 0.7.10. The impacted element is the function extension.apply of the file /src/cluster.ts of the component Outbound Request Handler. Such manipulation of the argument https/ip/port/path/headers leads to server-side request forgery. The attack may be performed from remote.

Affected products

NucleoidAI Nucleoid: 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5 (+5)

References

https://github.com/lakshayyverma/CVE-Discovery/blob/main/Nucleoid.md
https://vuldb.com/?ctiid.328809
https://vuldb.com/?id.328809
https://vuldb.com/?submit.669928

Get alerted when CVE-2025-11864 or the next vulnerability affects your stack