CVE-2026-85691

MegaParse 0.0.55 exposes an unauthenticated server-side request forgery flaw (CWE-918) in its POST /v1/url API endpoint, which fetches caller-supplied URLs from the server. An attacker with network access to the API can submit internal service URLs or cloud metadata endpoints, and the fetched responses are returned directly in the JSON response for the attacker to read. This yields a high confidentiality impact — for example, reading internal service output or cloud instance metadata — with no integrity or availability impact, and CVSS 4.0 rates the flaw 8.7 (high). Any deployment running MegaParse 0.0.55 with the /v1/url endpoint reachable by untrusted clients is affected. There is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS is low (0.3%), indicating no confirmed exploitation at this time.

What to do: Restrict network access to MegaParse's /v1/url endpoint by placing it behind authentication and limiting which clients can reach the API; egress-restrict the MegaParse server and block access to cloud metadata endpoints (e.g., 169.254.169.254) so SSRF cannot reach them. Check the MegaParse project repository for a patched release beyond 0.0.55 and upgrade as soon as a fix is published, and validate or allowlist URLs supplied to the endpoint in the meantime.