What’s Vulnerable › Vulnerabilities

CVE-2025-15104: Nu Html Checker (validator.nu) - Restriction bypass vulnerability allowing local SSRF

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-16 · updated 2026-06-17
• Weakness: CWE-918

Description

Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost services. While the validator implements hostname-based protections to block direct access to localhost and 127.0.0.1, these controls can be bypassed using DNS rebinding techniques or domains that resolve to loopback addresses.This issue affects The Nu Html Checker (vnu): latest (commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd).

Affected products

• Validator: before 2026-01-11 — fixed in 2026-01-11

How to fix

Upgrade to a fixed version: Validator 2026-01-11. Check the vendor advisory for mitigations.

References

• https://fluidattacks.com/advisories/europe
• https://github.com/validator/validator
• https://fluidattacks.com/advisories/europe

Get alerted when CVE-2025-15104 or the next vulnerability affects your stack