Threat database

CVE-2026-43929 is a high-severity vulnerability in the felippe-regazio ssrfcheck library versions 1.3.0 and earlier. The library fails to block Server-Side Request Forgery (SSRF) attacks when private IP addresses are encoded as IPv4-mapped IPv6 addresses. This occurs because the Node.js WHATWG URL parser normalizes IPv4 addresses inside brackets to compressed hex form, which the library's regex does not detect. As a result, all seven IANA private IPv4 ranges, including cloud metadata IPs, are bypassed. Applications relying on isSSRFSafeURL() for SSRF protection are fully exposed to SSRF attacks. A patch is available, and the vendor manages remediation for this cloud-hosted service.

Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid. This oversight allows attackers to craft requests targeting these multicast addresses.