v1.3.3

[1.3.3] - 2026-10-27

Security

• Block private, loopback, link-local, and cloud metadata targets before an outbound fetch, including redirect targets.
• Correct the CGNAT check (100.64.0.0/10), which previously never matched.
• Block documentation ranges, IPv6 multicast, site-local addresses, and private addresses embedded in 6to4, NAT64, and IPv4-mapped or IPv4-compatible IPv6.
• Stop node-fetch from following redirects itself (redirect: 'manual') and resolve protocol-relative //host redirects before validating them.
• Pin direct HTTP(S) connections to the addresses that passed validation.
• Do not fall back to browser mode after a blocked URL. Browser mode now checks redirects and subresources and keeps Chrome private-network protection on unless ALLOW_PRIVATE_NETWORK_REQUESTS=true.

Fixed

• Apply the configured proxy to browser mode, including proxy changes and proxy credentials.
• Honor NO_PROXY / no_proxy when selecting a system proxy.
• Keep caller headers when stored cookies are attached in browser mode.
• Close the browser page when a browser fetch fails.
• Convert the full HTML document to plain text or Markdown in browser mode before chunking.
• Honor a byte cursor that lands in the middle of a stored chunk.
• Truncate oversized content on UTF-8 byte boundaries.

Changed

• Package version 1.3.3 was not published. This release includes the SSRF work already on main and the fixes above.

中文

安全

• 在出站抓取前拦截私网、环回、链路本地和云元数据地址，重定向目标同样校验。
• 修正原先永远不会命中的运营商级 NAT 网段 100.64.0.0/10。
• 拦截文档地址、IPv6 组播、站点本地地址，以及嵌在 6to4、NAT64、IPv4 映射或 IPv4 兼容地址里的私网 IPv4。
• node-fetch 改为 redirect: 'manual'，由本服务自己跟随重定向；协议相对地址 //host 会先解析再校验。
• 直连 HTTP(S) 时，套接字固定到已通过校验的地址。
• URL 被拦截后不再自动改走浏览器。浏览器模式会检查重定向和子资源；除非设置 ALLOW_PRIVATE_NETWORK_REQUESTS=true，否则不再关闭 Chrome 的私网请求保护。

修复

• 浏览器模式会实际使用配置的代理，代理变更时重启浏览器，并支持代理认证。
• 选择系统代理时遵守 NO_PROXY / no_proxy。
• 浏览器模式附带已保存 Cookie 时，不再覆盖调用方传入的请求头。
• 浏览器抓取失败时关闭页面。
• 浏览器模式先转换完整 HTML，再做纯文本或 Markdown 分块。
• 字节游标落在分块中间时，从该偏移继续返回。
• 超长内容按 UTF-8 字节边界截断。

变更

• 1.3.3 此前没有发布。本版本包含已经在 main 上的 SSRF 防护，以及上面的修复。