Nu Html Checker (validator.nu) - Restriction bypass vulnerability allowing local SSRF

published 2026-01-16 9 mo ago modified 2026-06-17 4 mo ago also GHSA-fccg-7w3p-w66f , EUVD-2026-2919

cvss: 5.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits: 0; none known

Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost services. While the validator implements hostname-based protections to block direct access to localhost and 127.0.0.1, these controls can be bypassed using DNS rebinding techniques or domains that resolve to loopback addresses.This issue affects The Nu Html Checker (vnu): latest (commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd).

Patch / fix

fixed in 1

validator validator 2026-01-11

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 9 mo ago (2026-01-16)

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

fluidattacks.com https://fluidattacks.com/advisories/europe referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	nu.validator:validator	<=26.1.11	no fix listed
npm	vnu-jar	<=26.1.11	no fix listed

Affected products

The Nu Html Checker The Nu Html Checker

Classification

Weakness

CWE-918 Server-Side Request Forgery

References

fluidattacks.com /advisories/europe
third-party-advisory, exploit, web
github.com /validator/validator
product, package
nvd.nist.gov /vuln/detail/CVE-2025-15104
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary