CVE-2026-49857

## SSRF Protection Bypass via IPv4-mapped IPv6 Loopback ### Summary `auth-fetch-mcp` v3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable and carries a CVSS v3.1 Base Score of **7.4 (High)**. ### Details The vulnerable function is `isPrivateV6()` in `src/security.ts`, called from `assertSafeUrl()` which gates every outbound request made by the `auth_fetch` and `download_media` MCP tools. **Root cause — `src/security.ts:46-50`:** ```ts if (lower.startsWith("::ffff:")) { const v4 = lower.slice(7); // "7f00:1" after Node normalization if (net.isIPv4(v4)) return isPrivateV4(v4); // false → falls through } return false; // loopback escapes the guard ``` The Node.js WHATWG URL class (conforming to the URL Living Standard) hex-normalizes IPv4-mapped IPv6 addresses: | Input hostname | After `new URL(...).hostname` | |---|---| | `::ffff:127.0.0.1` | `::ffff:7f00:1` | | `::ffff:192.168.1.1` | `::ffff:c0a8:101` | After normalization, the suffix after `::ffff:` is no longer a dotted-decimal IPv4 string, so `net.isIPv4()` returns `false`. The guard falls through and `isPrivateV6()` returns `false`, causing `assertSafeUrl()` to treat a loopback address as safe. **Data flow — primary sink (`auth_fetch`):** 1. `src/tools.ts:119` — `auth_fetch` accepts user-controlled `url: z.string()` (source). 2. `src/tool