Skip to main content

Server-Side Request Forgery (SSRF)

CVE-2026-44578

Low
0/10

Summary

Self-hosted applications using the built-in Node.js server can be vulnerable to Server-Side Request Forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. This issue affects starting from 13.4.13-canary.0 through 15.5.15 and 16.0.0-beta.0 through 16.2.4.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published