CVE-2025-54590 Overview
CVE-2025-54590 is a Server-Side Request Forgery (SSRF) vulnerability in webfinger.js, a TypeScript-based WebFinger client library used in browsers and Node.js environments. The lookup function in versions 2.8.0 and below accepts user-supplied addresses without properly restricting access to internal hosts. The library only blocks hosts that start with localhost and end with a port, leaving other loopback representations and internal network addresses reachable. Attackers can craft addresses that cause the client to issue GET requests to arbitrary hosts, paths, and ports on the instance's local network. The issue is tracked under [CWE-918] and resolved in version 2.8.1.
Critical Impact
Attackers can trigger blind SSRF requests against internal services reachable from the host running the vulnerable webfinger.js client.
Affected Products
- webfinger.js versions 2.8.0 and below
- Node.js applications embedding webfinger.js for ActivityPub or WebFinger lookups
- Browser-based clients bundling vulnerable webfinger.js releases
Discovery Timeline
- 2025-08-01 - CVE CVE-2025-54590 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54590
Vulnerability Analysis
The lookup function in webfinger.js accepts an address string that determines the host, port, and path used in outbound HTTP GET requests. The WebFinger and ActivityPub specifications expect clients to block requests to localhost and other loopback destinations in production. The library implements only a narrow filter that matches hosts beginning with the literal string localhost and ending with a port. This filter does not cover alternate loopback representations such as 127.0.0.1, [::1], 0.0.0.0, DNS names resolving to internal IPs, or private ranges like 10.0.0.0/8 and 192.168.0.0/16. An attacker who controls a WebFinger address value can direct the client to probe internal HTTP endpoints reachable from the server. Because responses are not returned to the caller in a structured way, the vulnerability produces blind SSRF, which is still sufficient to reach unauthenticated internal APIs and metadata services.
Root Cause
The root cause is insufficient input validation and destination filtering in the URL construction path of lookup. The allowlist and blocklist logic assumes attackers will only supply strings that literally contain localhost, ignoring the many equivalent ways to address the local host or internal networks.
Attack Vector
An attacker submits a crafted user address to any application feature that calls webfinger.lookup. The library then issues a GET request to the attacker-chosen host, path, and port. This request originates from the server hosting the vulnerable client, so it reaches services otherwise inaccessible from the public internet, including cloud instance metadata endpoints, internal admin panels, and databases with HTTP interfaces. See the GitHub Security Advisory GHSA-8xq3-w9fx-74rv for the maintainer's technical description.
Detection Methods for CVE-2025-54590
Indicators of Compromise
- Outbound HTTP GET requests from application servers targeting 127.0.0.1, 169.254.169.254, or RFC1918 addresses on non-standard ports.
- WebFinger lookup calls containing suspicious address values referencing IP literals, unusual ports, or internal hostnames.
- Application logs showing webfinger.js lookup failures with connection targets inside the trust boundary.
Detection Strategies
- Inventory Node.js and browser projects that depend on webfinger.js and flag versions at or below 2.8.0.
- Instrument the lookup function or its underlying fetch calls to log resolved destination hosts before the request is sent.
- Correlate WebFinger request patterns with egress proxy logs to identify addresses that resolve to internal networks.
Monitoring Recommendations
- Monitor egress traffic from application tiers for connections to cloud metadata services such as 169.254.169.254 and to loopback interfaces.
- Alert on repeated WebFinger lookups from a single user or session that produce host resolution to private ranges.
- Track dependency manifests in CI pipelines and fail builds that pull webfinger.js versions prior to 2.8.1.
How to Mitigate CVE-2025-54590
Immediate Actions Required
- Upgrade webfinger.js to version 2.8.1 or later across all Node.js and browser bundles.
- Audit application entry points that accept user-supplied WebFinger or ActivityPub addresses and validate them server-side.
- Restrict outbound network access from application servers so that lookup traffic cannot reach internal services or metadata endpoints.
Patch Information
The fix is available in webfinger.js version 2.8.1. See the GitHub Release v2.8.1 notes and the corresponding GitHub Commit Details for the code changes that expand host validation beyond the narrow localhost check.
Workarounds
- Place an egress proxy in front of the application that denies requests to loopback, link-local, and RFC1918 destinations.
- Wrap the lookup function with a resolver that rejects addresses whose DNS resolution returns internal IP addresses.
- Disable WebFinger lookups for untrusted users until the upgrade to 2.8.1 is deployed.
# Configuration example
npm install webfinger.js@2.8.1
npm ls webfinger.js
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
