CVE-2026-82801: Server-Side Request Forgery in NASA earthdata-search

This vulnerability exists in the scaleImage function of the file serverless/src/scaleImage/handler.js in NASA earthdata-search 1.0.0. An attacker can remotely manipulate this function to perform server-side request forgery, potentially causing the server to make unintended requests. The vulnerability is publicly disclosed with exploit code available, but no official remediation or patch has been provided by the vendor.

Successful exploitation allows remote attackers to induce the server to make arbitrary requests, which may lead to information disclosure or interaction with internal systems. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should consider implementing network-level restrictions or input validation to mitigate SSRF risks until an official fix is released.