What’s Vulnerable › Vulnerabilities

CVE-2025-9960: is-localhost-ip 2.0.0 - SSRF via Restrictions bypass

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-22 · updated 2026-10-19
• Weakness: CWE-918

Description

A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF). This issue affects is-localhost-ip: 2.0.0.

Affected products

• is-localhost-ip: 2.0.0

References

• https://fluidattacks.com/advisories/registrada
• https://github.com/tinovyatkin/is-localhost-ip

Get alerted when CVE-2025-9960 or the next vulnerability affects your stack