The ssrfcheck library, used to detect potential SSRF attacks, does not properly handle IPv4-mapped IPv6 addresses due to normalization by the Node.js WHATWG URL parser. The library's regex only matches dot-notation IPv4 addresses and fails to recognize compressed hex IPv6 forms representing private IPs. This allows attackers to bypass SSRF protections by encoding private IP addresses in IPv6 format, exposing applications using isSSRFSafeURL() to SSRF vulnerabilities. The vulnerability affects versions 1.3.0 and earlier. The vendor provides a patch, and since this is a cloud service, remediation is managed by the vendor.

Successful exploitation allows attackers to bypass SSRF protections and send unauthorized requests to internal or cloud metadata IP addresses, potentially leading to information disclosure. The vulnerability impacts confidentiality (high impact), with limited integrity impact and no availability impact. No known exploits are reported in the wild at this time.

A patch is available for this vulnerability. Since ssrfcheck is a cloud-hosted service, the vendor manages remediation server-side. Users should verify that their environment is updated to a patched version beyond 1.3.0 or confirm with the vendor that the service is patched. No additional mitigation steps are indicated by the vendor advisory.