The ssrfcheck library attempts to prevent SSRF attacks by checking URLs for private IP addresses using regex matching on IPv4 dot notation. However, Node.js's WHATWG URL parser normalizes IPv4-mapped IPv6 addresses (e.g., [::ffff:127.0.0.1]) into compressed hex form before ssrfcheck's regex runs. Since the regex only matches IPv4 dot notation, it fails to detect these normalized IPv6 representations of private IPs, allowing SSRF bypasses. This affects all private IPv4 ranges, including critical cloud metadata IPs like 169.254.169.254. The vulnerability is tracked as CVE-2026-43929 with a CVSS 3.1 score of 8.2 (high severity). The vendor provides a patch and manages remediation for the cloud-hosted service.

Applications relying on ssrfcheck version 1.3.0 or earlier to prevent SSRF attacks are vulnerable to bypass via IPv4-mapped IPv6 addresses. This can lead to unauthorized internal network requests, potentially exposing sensitive internal services or cloud metadata endpoints. The confidentiality impact is high, while integrity impact is low and availability impact is none, per the CVSS vector. No known exploits have been reported in the wild.

A patch is available for ssrfcheck to address this vulnerability. Since ssrfcheck is provided as a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance has been updated. Applications should avoid relying solely on isSSRFSafeURL() from vulnerable versions until remediation is confirmed.