Skip to content
OpenAdvisories

Package · npm

webfinger.js

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium 6.9
    CVE-2025-54590

    webfinger.js is vulnerable to Blind SSRF attacks through localhost

    webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accepts user addresses for account checking. However, the ActivityPub specification requires preventing a…

    silverbucket webfinger.js webfinger.js npm