uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) (GHSA-x8rq-rc7x-5fg5)

Description

uppy’s companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.

Recommendation

Update the uppy package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.3
• Patched version(s): 2.3.3

References

• GHSA-x8rq-rc7x-5fg5
• huntr.dev
• CVE-2022-0086
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• x402 SDK vulnerable in outdated versions in resource servers for builders (GHSA-3j63-5h8p-gf7c) 3 - Vulnerability
• Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548
• jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label - CVE-2022-31160
• Opening a malicious website while running a Nuxt dev server could allow read-only access to code - CVE-2025-24361

Tags:

npm

uppy