CVE-2026-47684: @sync-in/server SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
Summary
CVE-2026-47684: Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP. Affects @sync-in/server versions < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @sync-in/server package is a Node.js library designed for managing file operations, including downloading files from URLs. It provides functionalities that allow users to interact with files efficiently. However, it has a vulnerability that can be exploited to bypass server-side request forgery (SSRF) protections, particularly on dual-stack systems where both IPv4 and IPv6 are used.
Vulnerability Detail
The vulnerability arises from the regex used to block private IP addresses in the URL download feature. The regex does not account for IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1), which can lead to SSRF protection being bypassed. This allows an attacker to craft a URL that points to an internal address, potentially exposing sensitive internal resources. The affected components include the downloadFromUrl() function in files-manager.service.ts and the regExpPrivateIP regex in url-file.ts.
How To Fix
Latest published version: 2.6.0 as of 23 Oct 2026
npm install @sync-in/server@2.6.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
npm install @sync-in/server@2.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually modify the regex in the url-file.ts file to include checks for IPv4-mapped IPv6 addresses. However, this is not recommended as a long-term solution. Instead, ensure that you update to the patched version as soon as possible.
Conclusion
The CVE-2026-47684 vulnerability in the @sync-in/server package allows for SSRF protection bypass through IPv4-mapped IPv6 addresses. It is crucial to update to version 2.3.0 or later to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for @sync-in/server →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources.
If your application uses the affected version of @sync-in/server, an attacker could exploit this vulnerability to access internal resources that should be protected.
IPv4-mapped IPv6 addresses are a way to represent IPv4 addresses within an IPv6 address format, allowing dual-stack systems to handle both protocols.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @sync-in/server.
