CVE-2025-9960: is-localhost-ip SSRF Vulnerability

CVE-2025-9960 Overview

CVE-2025-9960 is a restriction bypass vulnerability in the is-localhost-ip npm package version 2.0.0. The flaw allows attackers to bypass localhost detection logic and perform Server-Side Request Forgery (SSRF) attacks [CWE-918]. Applications rely on is-localhost-ip to validate whether a supplied hostname or IP resolves to a loopback address before initiating outbound requests. When the check returns an incorrect result, an attacker-controlled input can reach internal services that were intended to be blocked.

Critical Impact
Attackers can bypass loopback address validation to trigger SSRF against internal network resources, cloud metadata endpoints, and other services shielded by localhost filtering.

Affected Products

is-localhost-ip npm package, version 2.0.0
Node.js applications that use is-localhost-ip as an SSRF guard
Downstream libraries and services that depend on is-localhost-ip for URL validation

Discovery Timeline

2025-09-22 - CVE-2025-9960 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9960

Vulnerability Analysis

The is-localhost-ip package exposes a function that returns true when a hostname or IP address maps to a loopback interface. Applications wrap outbound HTTP clients with this check to prevent SSRF against 127.0.0.0/8, ::1, and other local resources. In version 2.0.0, the validation logic fails to account for the full range of representations that resolve to loopback addresses. An attacker who controls the hostname parameter can craft an input that is judged non-local, yet still resolves to an internal address when the request is executed.

The practical consequence is a Server-Side Request Forgery primitive. Requests can be redirected to cloud instance metadata services, internal admin consoles, or lateral services on the same host. The vulnerability is network-reachable, requires no authentication, and no user interaction.

Root Cause

The root cause is incomplete input validation of hostname and IP representations. The check does not normalize alternative encodings, decimal or octal IP notations, IPv6-mapped IPv4 forms, or DNS records that resolve to loopback. This gap between what the validator inspects and what the underlying network stack resolves is the classic pattern behind SSRF bypasses in allow-list and deny-list filters.

Attack Vector

Exploitation requires an application endpoint that accepts a user-supplied URL or hostname and passes it through is-localhost-ip before making an outbound request. An attacker submits a hostname that evades the loopback check but resolves to an internal address. The server then issues the request on the attacker's behalf. Refer to the Fluid Attacks Security Advisory and the is-localhost-ip GitHub repository for technical details on the bypass patterns.

Detection Methods for CVE-2025-9960

Indicators of Compromise

Outbound HTTP requests from application servers to 127.0.0.1, 169.254.169.254, or RFC1918 ranges immediately following user input processing
Application logs showing hostname parameters using decimal, octal, hex, or IPv6-mapped IPv4 notations
Requests to cloud metadata endpoints originating from workloads that should not normally query them

Detection Strategies

Inventory Node.js projects and lockfiles for is-localhost-ip@2.0.0 using Software Composition Analysis tools
Instrument outbound HTTP clients to log the resolved IP address alongside the original hostname for correlation
Add web application firewall rules that flag URL parameters containing non-standard IP encodings

Monitoring Recommendations

Monitor egress traffic from application tiers to internal address space and alert on anomalies
Enable cloud provider metadata service protections such as IMDSv2 on AWS to raise the bar for SSRF abuse
Track dependency updates for is-localhost-ip and downstream packages that embed it

How to Mitigate CVE-2025-9960

Immediate Actions Required

Audit application dependencies for is-localhost-ip@2.0.0 and identify every code path that relies on it for SSRF protection
Replace or supplement the check with a validator that resolves the hostname and inspects the resulting IP against a canonical block list
Enforce network-level egress controls that prevent application workloads from reaching loopback and link-local addresses

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for CVE-2025-9960. Monitor the is-localhost-ip GitHub repository for a patched release and upgrade as soon as one is available.

Workarounds

Perform DNS resolution server-side and validate the returned IP addresses against loopback, link-local, and private ranges before issuing outbound requests
Route outbound traffic through an egress proxy that enforces an allow list of permitted destinations
Disable or restrict features that accept user-supplied URLs until validation is hardened

bash

# Configuration example: audit lockfiles for the vulnerable version
npm ls is-localhost-ip
grep -R "is-localhost-ip" package-lock.json yarn.lock pnpm-lock.yaml