CVE-2026-43929

The record

ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlier, ssrfcheck fails to block Server-Side Request Forgery attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address (e.g. http://[::ffff:127.0.0.1]/). The WHATWG URL parser built into Node.js silently normalizes the IPv4 notation inside the brackets to compressed hex form ([::ffff:7f00:1]) before the library's private-IP regex ever runs. The regex was written to match dot-notation only and therefore never matches any real input — all seven IANA private IPv4 ranges, including the AWS/GCP/Azure metadata address 169.254.169.254, are bypassed. Any application using isSSRFSafeURL() to guard HTTP requests made with user-supplied URLs is fully exposed to SSRF.

Affected packages

Related vulnerabilities

• GHSA-j4rj-2jr5-m439 ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of… Same vulnerability
• GHSA-p4hc-9pjh-55c8 ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid Also affects ssrfcheck
• CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
• CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
• CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-184
• CVE-2026-102828 simple-git, an interface for running git commands in any node.js application, enables… CWE-184
• CVE-2026-102829 simple-git, an interface for running git commands in any node.js application, enables… CWE-184
• CVE-2026-87985 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass… CWE-184