# CVE-2026-100863: Heym server-side request forgery in image fetching and IPv6 validation

Source: https://junglewise.ai/threats/cve-2026-100863-heym-versions-0-0-90-and-earlier-contain-two-server-side-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-100863 · Severity: medium · CVSS 5 · Published 2026-09-27

Heym is a workflow automation platform that processes user-supplied URLs and network requests. The vulnerability allows attackers with API or webhook access to redirect image fetches to internal servers, loopback addresses, or cloud metadata endpoints through two flaws: unguarded HTTP image downloads and incomplete IPv6 address validation. This could expose internal services, cloud credentials, or private data.

Technologies: [Heym](https://junglewise.ai/threats/technologies/heym-heym). Vendors: [Heym](https://junglewise.ai/threats/vendors/heym).

## Quick answers

**Is CVE-2026-100863 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100863 being exploited in the wild.

**How severe is CVE-2026-100863?** Medium severity, with a CVSS score of 5, published 27 September 2026.

**Which products and versions are affected?** Heym 0.0.90 and earlier.

**Is there a fix for CVE-2026-100863?** A patch was published on 2026-09-27: Version 0.0.91 released with fixes to ssrf_guard.py Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100863 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100863?** Check whether you run Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The image-edit loader (_load_image_bytes) fetches caller-controlled HTTP/HTTPS URLs using bare httpx.get with only scheme validation, bypassing the egress-pinning HTTP client used for HTTP nodes. Additionally, _is_public_address fails to validate IPv6 transition forms (NAT64 64:ff9b::/96, IPv4-compatible ::x.x.x.x, 6to4 2002::/16), allowing embedded loopback or RFC1918 addresses to pass both initial validation and dial-time IP pinning. Version 0.0.91 routes image loads through the guarded HTTP client with full address validation and explicit rejection of transition prefixes.

## Affected products

- Heym Heym 0.0.90 and earlier

## Timeline

- 2026-08-15: disclosed: GitHub Security Advisory GHSA-6rph-qqcv-jqh4 published
- 2026-09-27: patched: Version 0.0.91 released with fixes to ssrf_guard.py

## References

- [https://github.com/heymrun/heym/security/advisories/GHSA-6rph-qqcv-jqh4](https://github.com/heymrun/heym/security/advisories/GHSA-6rph-qqcv-jqh4)
- [https://www.vulncheck.com/advisories/heym-before-0.0.91-ssrf-via-image-fetching-and-ipv6-validation](https://www.vulncheck.com/advisories/heym-before-0.0.91-ssrf-via-image-fetching-and-ipv6-validation)

## Related threats

- [Heym command injection via MCP stdio transport](https://junglewise.ai/threats/cve-2026-67546-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym HTTP node server-side request forgery](https://junglewise.ai/threats/cve-2026-67545-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym workflow engine arbitrary code execution via Playwright node](https://junglewise.ai/threats/cve-2026-67544-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym Python skill execution privilege escalation](https://junglewise.ai/threats/cve-2026-67543-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym server-side request forgery in MCP transports](https://junglewise.ai/threats/cve-2026-67542-heym-builds-and-runs-agentic-systems-and-business-process)