CVE-2026-49857

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl() (src/security.ts) to block requests to private and loopback addresses. However, the isPrivateV6() function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as http://[::ffff:127.0.0.1]:PORT/, the Node.js WHATWG URL parser silently normalizes the host to [::ffff:7f00:1]. Because net.isIPv4('7f00:1') returns false, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable. Version 3.0.1 patches the issue.

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl() (src/security.ts) to block requests to private and loopback addresses. However, the isPrivateV6() function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as http://[::ffff:127.0.0.1]:PORT/, the Node.js WHATWG URL parser silently normalizes the host to [::ffff:7f00:1]. Because net.isIPv4('7f00:1') returns false, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable. Version 3.0.1 patches the issue.

SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

Summary

auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl() (src/security.ts) to block requests to private and loopback addresses. However, the isPrivateV6() function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as http://[::ffff:127.0.0.1]:PORT/, the Node.js WHATWG URL parser silently normalizes the host to [::ffff:7f00:1]. Because net.isIPv4('7f00:1') returns false, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable and carries a CVSS v3.1 Base Score of 7.4 (High).

Details

The vulnerable function is isPrivateV6() in src/security.ts, called from assertSafeUrl() which gates every outbound request made by the auth_fetch and download_media MCP tools.

Root cause — src/security.ts:46-50:

if (lower.startsWith("::ffff:")) {
  const v4 = lower.slice(7);          // "7f00:1" after Node normalization
  if (net.isIPv4(v4)) return isPrivateV4(v4);  // false → falls through
}
return false;   // loopback escapes the guard

The Node.js WHATWG URL class (conforming to the URL Living Standard) hex-normalizes IPv4-mapped IPv6 addresses:

| Input hostname | After new URL(...).hostname | |---|---| | ::ffff:127.0.0.1 | ::ffff:7f00:1 | | ::ffff:192.168.1.1 | ::ffff:c0a8:101 |

After normalization, the suffix after ::ffff: is no longer a dotted-decimal IPv4 string, so net.isIPv4() returns false. The guard falls through and isPrivateV6() returns false, causing assertSafeUrl() to treat a loopback address as safe.

Data flow — primary sink (auth_fetch):

1. src/tools.ts:119 — auth_fetch accepts user-controlled url: z.string() (source).
2. src/tools.ts:128-131 — handler calls navigateTo(ctx, url), passing the raw URL.
3. src/browser.ts:58 — navigateTo() calls assertSafeUrl(url).
4. src/security.ts:74-108 — assertSafeUrl() delegates IPv6 host validation to isPrivateV6(); hex-normalized loopback bypasses the check.
5. src/browser.ts:66 — page.goto(safeUrl.toString()) issues a browser request to the internal address.
6. src/extractor.ts:33-54 / src/tools.ts:171-176 — page content is extracted and returned to the MCP caller.

Data flow — secondary sink (download_media):

1. src/tools.ts:198-210 — download_media accepts user-controlled urls[].
2. src/tools.ts:233-234 — each URL passes through assertSafeUrl() then ctx.request.get(safeUrl.toString()).
3. src/tools.ts:253-254 — the response body is written to the local downloads directory and the path is returned.

Dynamic confirmation (Phase 2):

The PoC ran inside a Docker container (--network=host). Direct loopback URLs are correctly blocked:

[BASELINE-BLOCK] Refusing to fetch 127.0.0.1 (resolves to private/loopback/link-local address 127.0.0.1)
[BASELINE-BLOCK] Refusing to fetch [::1] (resolves to private/loopback/link-local address ::1)

The IPv4-mapped IPv6 form bypasses the check and reaches the internal service:

[VULN] SECURITY_BYPASS: assertSafeUrl() did not throw
[VULN] Input URL:       http://[::ffff:127.0.0.1]:31337/
[VULN] Normalized URL:  http://[::ffff:7f00:1]:31337/
[VULN] Cause: net.isIPv4('7f00:1') = false → isPrivateV6() returns false
[SSRF] HTTP response received from internal service
[CONFIRMED] SSRF_CONFIRMED: response contains INTERNAL_SECRET_MARKER
[CONFIRMED] VULNERABILITY_REPRODUCED=TRUE

PoC

Prerequisites:

git clone https://github.com/ymw0407/auth-fetch-mcp.git
cd auth-fetch-mcp
npm ci
npm run build
npx playwright install --with-deps chromium

Terminal 1 — start a loopback-only internal service:

node -e…

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl() (src/security.ts) to block requests to private and loopback addresses. However, the isPrivateV6() function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as http://[::ffff:127.0.0.1]:PORT/, the Node.js WHATWG URL parser silently normalizes the host to [::ffff:7f00:1]. Because net.isIPv4('7f00:1') returns false, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable. Version 3.0.1 patches the issue.

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl() (src/security.ts) to block requests to private and loopback addresses. However, the isPrivateV6() function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as http://[::ffff:127.0.0.1]:PORT/, the Node.js WHATWG URL parser silently normalizes the host to [::ffff:7f00:1]. Because net.isIPv4('7f00:1') returns false, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable. Version 3.0.1 patches the issue.

SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

Summary

auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl() (src/security.ts) to block requests to private and loopback addresses. However, the isPrivateV6() function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as http://[::ffff:127.0.0.1]:PORT/, the Node.js WHATWG URL parser silently normalizes the host to [::ffff:7f00:1]. Because net.isIPv4('7f00:1') returns false, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable and carries a CVSS v3.1 Base Score of 7.4 (High).

Details

The vulnerable function is isPrivateV6() in src/security.ts, called from assertSafeUrl() which gates every outbound request made by the auth_fetch and download_media MCP tools.

Root cause — src/security.ts:46-50:

if (lower.startsWith("::ffff:")) {
  const v4 = lower.slice(7);          // "7f00:1" after Node normalization
  if (net.isIPv4(v4)) return isPrivateV4(v4);  // false → falls through
}
return false;   // loopback escapes the guard

The Node.js WHATWG URL class (conforming to the URL Living Standard) hex-normalizes IPv4-mapped IPv6 addresses:

| Input hostname | After new URL(...).hostname | |---|---| | ::ffff:127.0.0.1 | ::ffff:7f00:1 | | ::ffff:192.168.1.1 | ::ffff:c0a8:101 |

After normalization, the suffix after ::ffff: is no longer a dotted-decimal IPv4 string, so net.isIPv4() returns false. The guard falls through and isPrivateV6() returns false, causing assertSafeUrl() to treat a loopback address as safe.

Data flow — primary sink (auth_fetch):

1. src/tools.ts:119 — auth_fetch accepts user-controlled url: z.string() (source).
2. src/tools.ts:128-131 — handler calls navigateTo(ctx, url), passing the raw URL.
3. src/browser.ts:58 — navigateTo() calls assertSafeUrl(url).
4. src/security.ts:74-108 — assertSafeUrl() delegates IPv6 host validation to isPrivateV6(); hex-normalized loopback bypasses the check.
5. src/browser.ts:66 — page.goto(safeUrl.toString()) issues a browser request to the internal address.
6. src/extractor.ts:33-54 / src/tools.ts:171-176 — page content is extracted and returned to the MCP caller.

Data flow — secondary sink (download_media):

1. src/tools.ts:198-210 — download_media accepts user-controlled urls[].
2. src/tools.ts:233-234 — each URL passes through assertSafeUrl() then ctx.request.get(safeUrl.toString()).
3. src/tools.ts:253-254 — the response body is written to the local downloads directory and the path is returned.

Dynamic confirmation (Phase 2):

The PoC ran inside a Docker container (--network=host). Direct loopback URLs are correctly blocked:

[BASELINE-BLOCK] Refusing to fetch 127.0.0.1 (resolves to private/loopback/link-local address 127.0.0.1)
[BASELINE-BLOCK] Refusing to fetch [::1] (resolves to private/loopback/link-local address ::1)

The IPv4-mapped IPv6 form bypasses the check and reaches the internal service:

[VULN] SECURITY_BYPASS: assertSafeUrl() did not throw
[VULN] Input URL:       http://[::ffff:127.0.0.1]:31337/
[VULN] Normalized URL:  http://[::ffff:7f00:1]:31337/
[VULN] Cause: net.isIPv4('7f00:1') = false → isPrivateV6() returns false
[SSRF] HTTP response received from internal service
[CONFIRMED] SSRF_CONFIRMED: response contains INTERNAL_SECRET_MARKER
[CONFIRMED] VULNERABILITY_REPRODUCED=TRUE

PoC

Prerequisites:

git clone https://github.com/ymw0407/auth-fetch-mcp.git
cd auth-fetch-mcp
npm ci
npm run build
npx playwright install --with-deps chromium

Terminal 1 — start a loopback-only internal service:

node -e…