8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-8267

CVE-2025-8267: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability

Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid. This oversight allows attackers to craft requests targeting these multicast addresses.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-8267

CVE-2025-8267:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ssrfcheck	npm	< 1.2.0	1.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in an incomplete IP address denylist within the ssrfcheck library, which is intended to prevent Server-Side Request Forgery (SSRF) attacks. The core of the issue is in the src/is-private-ip.js file, where a constant array PRIVATE_CIDRS defines the IP ranges that should be blocked. Before the patch, this list was missing the 224.0.0.0/4 multicast IP range.

The function privIp4(ip) is directly responsible for checking IPv4 addresses against this list. It iterates through each CIDR in PRIVATE_CIDRS and checks if the input ip falls within that range. Because the multicast range was absent, privIp4 would fail to identify an IP like 224.0.0.1 as a reserved address, allowing a request to it to proceed.

The primary entry point for this functionality is the exported function isPrivateIP(ip, version), which calls privIp4 for IPv4 addresses. Therefore, any application using isPrivateIP to validate user-supplied URLs or IPs was vulnerable.

The patch, identified by commit 9507b49fd764f2a1a1d1e3b9ee577b7545e6950e, rectifies this by simply adding '224.0.0.0/4' to the PRIVATE_CIDRS array. This ensures that the privIp4 function, and by extension isPrivateIP, will now correctly identify and block requests to these multicast addresses. A runtime profile of an exploit would show calls passing through isPrivateIP to privIp4.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.