@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization

Description

The network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows private network access.

Recommendation

Update the @jshookmcp/jshook package to the latest compatible version. Followings are version details:

• Affected version(s): = 0.3.1
• Patched version(s): 0.3.2

References

• GHSA-c5r6-m4mr-8q5j
• CVE-2026-49856
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access - CVE-2026-31829
• OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() - CVE-2026-27728
• Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/nuxt - CVE-2026-42349
• pdfmake is vulnerable to server-side request forgery (SSRF) - CVE-2026-26801

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@jshookmcp/jshook