If you are running ssrf-agent 1.0.5 in your Node.js stack, you are vulnerable to a trivial SSRF bypass. A new report from the ssrf-lab repository, dated September 13, 2026, and published on Hacker News on October 13, confirms that the package—whose entire purpose is to prevent Server-Side Request Forgery—fails to block two specific loopback address spellings. The findings were measured on Node.js 22.13.0 and macOS, exposing a gap that persists even in the latest published version.

The Two Spells That Break The Filter

The testing suite sent seven different requests to a local service. While standard formats like http://127.0.0.1:PORT and http://2130706433:PORT were correctly blocked, two spellings slipped through: http://0.0.0.0:PORT and http://[::ffff:127.0.0.1]:PORT. The report emphasizes that these were not inferred from error messages but confirmed by a canary string returned by the internal service. This means the agent allowed the request, and the local host answered it, defeating the security boundary entirely.

Why Text-Based Checks Fail

The root cause is architectural. ssrf-agent delegates IP validation to the ip package, which uses pattern matching against text strings. The address 0.0.0.0 does not match any private range patterns in the ip library, so isPrivate returns false, and the OS routes the connection locally. Similarly, the IPv6-mapped form [::ffff:127.0.0.1] is normalized by Node.js to ::ffff:7f00:1 before the agent sees it. The agent’s regex patterns expect a dotted tail, so the hex form matches nothing and is treated as public. This is the same class of weakness found in CVE-2024-29415, proving that string-based IP validation is inherently fragile.

Maintainer Silence and Mitigation

The researcher reported the issue via email on September 13, 2026, but received no reply after 27 days. A second notice was filed on GitHub on October 10, and a CVE ID was requested from MITRE since no CNA covers the package. The suggested fix is straightforward: stop checking the text and start checking the parsed address. The report recommends using ipaddr.js to normalize inputs and explicitly forbidding the unspecified addresses 0.0.0.0 and ::. Until a patch lands, developers relying on this library for AI agent tooling or internal microservices are effectively unprotected against these specific vector attacks.

Key Takeaways

  • ssrf-agent 1.0.5 fails to block 0.0.0.0 and [::ffff:127.0.0.1], allowing SSRF to loopback.
  • The vulnerability stems from relying on the ip package’s text-pattern matching rather than parsed IP objects.
  • Node.js normalization of IPv6-mapped addresses bypasses the agent’s regex checks.
  • The maintainer has been silent for nearly a month, and the package has had no releases since November 2021.

The Bottom Line

Stop trusting string regexes for IP validation. If your agent tooling depends on ssrf-agent, you are running a security theater that breaks on the first hex-encoded address an LLM hallucinates.