@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

Description

The @utcp/http package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. registerManual() validates the discovery URL against an HTTPS / loopback allowlist, but callTool() reuses the resolved toolCallTemplate.url directly without revalidating, and the OpenApiConverter blindly trusts whatever servers[0].url an attacker-hosted spec declares.

Recommendation

Update the @utcp/http package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.1
• Patched version(s): 1.1.2

References

• GHSA-r8j5-8747-88cm
• CVE-2026-45366
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters - CVE-2026-42353
• PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled - Vulnerability
• i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters - CVE-2026-41690
• Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration - CVE-2026-45715

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@utcp/http