hemmelig allows SSRF Filter bypass via Secret Request functionality

Description

A Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding (e.g., localtest.me which resolves to 127.0.0.1) or open redirect services (e.g., httpbin.org/redirect-to).

Recommendation

Update the hemmelig package to the latest compatible version. Followings are version details:

• Affected version(s): < 7.3.3
• Patched version(s): 7.3.3

References

• GHSA-vvxf-wj5w-6gj5
• CVE-2025-69206
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter - CVE-2025-68150
• Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format - CVE-2025-64430
• IPX Allows Path Traversal via Prefix Matching Bypass - CVE-2025-54387
• Axios: no_proxy bypass via IP alias allows SSRF - CVE-2026-42038

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

CSRF, XXE, and 12 Other Security Acronyms Explained

Update Cheat Sheet for Developers

Tags:

npm

hemmelig