CVE-2026-43929: ssrfcheck Vulnerable to SSRF via IPv4-Mapped IPv6 Address Bypass
Summary
CVE-2026-43929: ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs. Affects ssrfcheck versions < 1.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ssrfcheck is a Node.js library designed to prevent Server-Side Request Forgery (SSRF) attacks by validating URLs before making outbound HTTP requests. It utilizes a regex-based approach to identify private IP addresses, ensuring that applications do not inadvertently expose sensitive internal resources to external requests. However, the library's current implementation fails to account for IPv4-mapped IPv6 addresses, rendering it vulnerable to SSRF attacks.
Vulnerability Detail
The vulnerability in ssrfcheck arises from its inability to properly validate IPv4-mapped IPv6 addresses, such as 'http://[::ffff:127.0.0.1]/'. The library relies on the WHATWG URL parser, which normalizes these addresses into a hex format, bypassing the regex checks intended to block private IP addresses. This oversight allows attackers to exploit the library by sending crafted URLs that can access internal services, cloud metadata, or localhost endpoints, leading to potential data breaches and unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can modify the existing regex checks in the src/is-private-ip.js file to include additional patterns for IPv4-mapped IPv6 addresses. However, this is not a permanent solution and should be replaced with the suggested fix as soon as possible.
Conclusion
The ssrfcheck library is vulnerable to SSRF attacks due to its failure to properly validate IPv4-mapped IPv6 addresses. This vulnerability can lead to serious security risks, including unauthorized access to internal resources. It is crucial to update to the patched version and consider implementing more robust validation methods to mitigate these risks.
See every vulnerability recorded for ssrfcheck →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
All versions of ssrfcheck up to and including 1.3.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
This vulnerability can enable attackers to perform SSRF attacks, allowing them to access internal services, cloud metadata, or localhost endpoints.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for ssrfcheck.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
