Threats tagged 'ghsa-p4hc-9pjh-55c8'

The ssrfcheck npm package has a Server-Side Request Forgery (SSRF) bypass vulnerability due to its failure to classify the reserved multicast IP address space 224.0.0.0/4 as invalid. This incomplete denylist allows URLs pointing to these reserved IPs to be incorrectly considered safe, potentially enabling SSRF attacks. All versions up to 1.1.1 are affected. A fix is available in version 1.2.0.