Vulnerability · Published Jan 16, 2026 · Assigned by Fluid Attacks

CVE-2025-15104Nu Html Checker (validator.nu) - Restriction bypass vulnerability allowing local SSRF

Medium 6.9

In plain English

A medium-severity server-side request forgery in The Nu Html Checker from The Nu Html Checker. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost services. While the validator implements hostname-based protections to block direct access to localhost and 127.0.0.1, these controls can be bypassed using DNS rebinding techniques or domains that resolve to loopback addresses.This issue affects The Nu Html Checker (vnu): latest (commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	vnu	no fix listed	DEBIAN-CVE-2025-15104
Maven	nu.validator:validator	no fix listed	GHSA-fccg-7w3p-w66f
Ubuntu:26.10	vnu	no fix listed	UBUNTU-CVE-2025-15104
npm	vnu-jar	no fix listed	GHSA-fccg-7w3p-w66f

Affected products (as reported)

Vendor	Product	Versions
The Nu Html Checker	The Nu Html Checker	latest - commit:23f090a11bab8d0d4e698f1ffc197a4fe226a9cd

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://fluidattacks.com/advisories/europe third-party-advisory
https://github.com/validator/validator product