Nu Html Checker (vnu) versions prior to 26.8.6 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows remote attackers to bypass hostname-based restrictions and make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost. The vulnerability is due to the ability to bypass protections using DNS rebinding or domains resolving to loopback addresses. A patch is available to fix this issue.