ssrfcheck is a validation library that incorrectly allows private IP addresses when they are encoded as IPv4‑mapped IPv6 strings, such as http://[::ffff:127.0.0.1]/. The WHATWG URL parser in Node.js normalizes the IPv4 notation inside the brackets to a compressed hex form before the library’s private‑IP regular expression is evaluated, but the regex only matches dot‑notation, so it never rejects valid private addresses. As a result, any user‑supplied URL containing an IPv4‑mapped IPv6 address bypasses the protection, enabling an attacker to make the host reach internal services or cloud‑metadata endpoints and possibly leak data or gain elevated access.

The flaw exists in ssrfcheck version 1.3.0 and earlier. Any Node.js application that imports this library and invokes isSSRFSafeURL() to guard outbound requests is exposed. All seven IANA private IPv4 ranges and the common cloud‑metadata address 169.254.169.254 are bypassed by the broken validation.

CVSS 8.2 marks the vulnerability as high severity. No EPSS score is currently available, and it is not listed in the CISA KEV catalog. An attacker who can influence the URL used by the application can supply a crafted IPv4‑mapped IPv6 string that will be converted to a private address after normalization, causing the host to send a request to an internal resource, thereby exposing the network to data exfiltration or potential compromise.