Executive brief
ssrfcheck is a software library used by developers to prevent Server-Side Request Forgery (SSRF) attacks by blocking requests to private internal IP addresses. A flaw in the library allows attackers to bypass these security checks by encoding internal IP addresses in a specific format (IPv4-mapped IPv6). This could allow an attacker to access sensitive internal services, such as cloud metadata services (AWS/GCP/Azure) or internal databases, which are normally protected from the public internet.
Technical details
The ssrfcheck library (v1.3.0 and earlier) is vulnerable to a Server-Side Request Forgery (SSRF) bypass due to improper input validation of IPv4-mapped IPv6 addresses. The library uses regular expressions to identify private IP ranges, but these regexes specifically look for dot-notation (e.g., ::ffff:127.0.0.1). However, the library processes URLs using the Node.js WHATWG URL parser, which automatically normalizes these addresses into compressed hexadecimal format (e.g., ::ffff:7f00:1) before the security check occurs. Because the library's regex does not account for the normalized hex format, all IANA private IPv4 ranges and cloud metadata addresses (169.254.169.254) can bypass the isSSRFSafeURL() check. This allows unauthenticated remote attackers to force the application to make requests to internal network resources.
Affected products
- felippe-regazio ssrfcheck <= 1.3.0
Timeline
- 2026-04-26: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE-2026-43929 published to NVD