CVE-2026-77866

Slab's safeurl URL-validation library fails to reliably block internal network destinations because it only matches IPv4 addresses against reserved ranges and its blocklist, treating every other address as matching nothing. An attacker who controls a URL that passes validation can bypass the filter by expressing the destination as an IPv6 address, by exploiting that IPv6 blocklist entries never match, or by using a hostname that resolves only to non-IPv4 addresses. Successful abuse is textbook SSRF: the attacker can reach internal-only services and reserved address space, with high confidentiality impact on the targeted system per the CVSS 4.0 score of 9.0 (critical). Applications using safeurl from 0.1.0 onward in blocklist (deny-list) mode are affected, while deployments that rely on the allowlist are not, because there an unmatched address is rejected. There is no public proof-of-concept, no known in-the-wild exploitation, and the flaw is not in the CISA KEV catalog.

What to do: Audit whether your applications use Slab safeurl in blocklist (deny-list) mode; if so, assume its internal-destination blocking is bypassable via IPv6. Switch to allowlist mode, which rejects unmatched addresses and is unaffected, and monitor for a patched release from Slab to upgrade to as soon as it ships. Compensate with network-level egress controls (denying outbound requests to link-local and reserved IPv6 space and to internal/metadata endpoints) rather than relying on application-layer URL filtering alone.