PT-2025-31675 · Unknown · Webfinger.Js

Ori Hollander + 1 · Published 2025-07-28 · Updated 2025-08-01 · CVE-2025-54590

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions webfinger.js versions 2.8.0 and below

Description webfinger.js is a TypeScript-based WebFinger client used in browser and Node.js environments. The lookup function does not prevent access to localhost services, only checking for hosts that start with "localhost" and end with a port. This allows attackers to perform blind Server-Side Request Forgery (SSRF) attacks by sending GET requests with controlled host, path, and port parameters to query services on the instance's host or local network.

Recommendations Update to version 2.8.1 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-54590

GHSA-8XQ3-W9FX-74RV

Affected Products

Webfinger.Js

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54590.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54590 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8xq3-w9fx-74rv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54590 · Security Note
• https://github.com/silverbucket/webfinger.js/security/advisories/GHSA-8xq3-w9fx-74rv · Note
• https://github.com/silverbucket/webfinger.js/releases/tag/v2.8.1 · Note
• https://github.com/silverbucket/webfinger.js · Note
• https://github.com/silverbucket/webfinger.js/commit/b5f2f2c957297d25f4d76072963fccaee2e3095a · Note
• https://twitter.com/CVEnew/status/1951355936972382391 · Twitter Post