Home

Description

Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost services. While the validator implements hostname-based protections to block direct access to localhost and 127.0.0.1, these controls can be bypassed using DNS rebinding techniques or domains that resolve to loopback addresses.This issue affects The Nu Html Checker (vnu): latest (commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd).

PUBLISHED Reserved 2025-12-26 | Published 2026-01-16 | Updated 2026-01-16 | Assigner Fluid Attacks




MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Problem types

CWE-918 Server-Side Request Forgery (SSRF)

Product status

Default status
unknown

latest - commit:23f090a11bab8d0d4e698f1ffc197a4fe226a9cd
affected

Credits

Oscar Uribe finder

References

fluidattacks.com/advisories/europe exploit

fluidattacks.com/advisories/europe third-party-advisory

github.com/validator/validator product

cve.org (CVE-2025-15104)

nvd.nist.gov (CVE-2025-15104)

Download JSON