CVE-2026-43929

ssrfcheck: Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs

Published May 12, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Description

ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlier, ssrfcheck fails to block Server-Side Request Forgery attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address (e.g. http://[::ffff:127.0.0.1]/). The WHATWG URL parser built into Node.js silently normalizes the IPv4 notation inside the brackets to compressed hex form ([::ffff:7f00:1]) before the library's private-IP regex ever runs. The regex was written to match dot-notation only and therefore never matches any real input — all seven IANA private IPv4 ranges, including the AWS/GCP/Azure metadata address 169.254.169.254, are bypassed. Any application using isSSRFSafeURL() to guard HTTP requests made with user-supplied URLs is fully exposed to SSRF.

Analysis

Technical impact

ssrfcheck is a validation library that incorrectly allows private IP addresses when they are encoded as IPv4‑mapped IPv6 strings, such as http://[::ffff:127.0.0.1]/. The WHATWG URL parser in Node.js normalizes the IPv4 notation inside the brackets to a compressed hex form before the library’s private‑IP regular expression is evaluated, but the regex only matches dot‑notation, so it never rejects valid private addresses. As a result, any user‑supplied URL containing an IPv4‑mapped IPv6 address bypasses the protection, enabling an attacker to make the host reach internal services or cloud‑metadata endpoints and possibly leak data or gain elevated access.

Affected Systems

The flaw exists in ssrfcheck version 1.3.0 and earlier. Any Node.js application that imports this library and invokes isSSRFSafeURL() to guard outbound requests is exposed. All seven IANA private IPv4 ranges and the common cloud‑metadata address 169.254.169.254 are bypassed by the broken validation.

Risk and Exploitability

CVSS 8.2 marks the vulnerability as high severity. No EPSS score is currently available, and it is not listed in the CISA KEV catalog. An attacker who can influence the URL used by the application can supply a crafted IPv4‑mapped IPv6 string that will be converted to a private address after normalization, causing the host to send a request to an internal resource, thereby exposing the network to data exfiltration or potential compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

felippe-regazio

ssrfcheck

affected

Version	Status	Constraints
`<= 1.3.0`	affected	—

No data.

Vendor Product Versions

Felipperegazio

Ssrf Check

Version	Status	Scheme	Platform
`[0,1.3.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ssrfcheck to the latest released version that fixes the IPv4‑mapped IPv6 validation issue
If an immediate upgrade is not possible, patch the library to modify the private‑IP regular expression to recognize IPv4‑mapped IPv6 strings or perform the check prior to URL parsing
Add independent outbound‑request filtering in the application, ensuring that only explicitly allowed hosts or networks are contacted, and do not rely solely on isSSRFSafeURL

Generated by OpenCVE AI on May 12, 2026 at 19:41 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-j4rj-2jr5-m439	ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.269% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/felippe-regazio/ssrfcheck/security/advisories/GHSA-j4rj-2jr5-m439

History

May 13, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 13, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Felipperegazio Felipperegazio ssrf Check
Vendors & Products		Felipperegazio Felipperegazio ssrf Check

May 12, 2026 6:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlier, ssrfcheck fails to block Server-Side Request Forgery attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address (e.g. http://[::ffff:127.0.0.1]/). The WHATWG URL parser built into Node.js silently normalizes the IPv4 notation inside the brackets to compressed hex form ([::ffff:7f00:1]) before the library's private-IP regex ever runs. The regex was written to match dot-notation only and therefore never matches any real input — all seven IANA private IPv4 ranges, including the AWS/GCP/Azure metadata address 169.254.169.254, are bypassed. Any application using isSSRFSafeURL() to guard HTTP requests made with user-supplied URLs is fully exposed to SSRF.
Title		ssrfcheck: Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs
Weaknesses		CWE-184 CWE-918
References		https://github.com/felippe-regazio/ssrfcheck/security/advisories/GHSA-j4rj-2jr5-m439
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}`