Description
The network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows private network access.
Recommendation
Update the @jshookmcp/jshook package to the latest compatible version. Followings are version details:
- Affected version(s): = 0.3.1
- Patched version(s): 0.3.2
References
Could your website be exposed too?
SmartScanner can check your website for @jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access - CVE-2026-31829
- OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() - CVE-2026-27728
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/nuxt - CVE-2026-42349
- pdfmake is vulnerable to server-side request forgery (SSRF) - CVE-2026-26801
You might also like:
See something that needs correcting? Let us knowUpdated July 01, 2026