Skip to content

v3.65.1 — security: http_fetch SSRF via DNS

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 30 Oct 19:21
· 34 commits to main since this release
v3.65.1
5ccd801

Security patch: @claude-flow/cli, claude-flow, ruflo 3.65.1. Contains 3.65.0 plus this one fix (#4605).

Security

  • http_fetch SSRF via DNS (CWE-918, CWE-350).
    • Before: the MCP tool refused loopback, RFC-1918 and link-local hosts only by the URL's hostname text, then let fetch() resolve the name itself. A hostname that resolves, or rebinds, to 127.0.0.1, a private address or 169.254.169.254 reached it without CLAUDE_FLOW_HTTP_FETCH_ALLOW_PRIVATE.
    • Now: every connection resolves through a lookup hook. The hook refuses the host if any resolved address is private, and the socket connects only to addresses it checked. Every redirect hop is checked the same way.
    • The address check also covers ::, IPv4-compatible and NAT64/6to4 IPv6 forms, fe80::/10, fec0::/10, ff00::/8, IPv4 multicast/reserved, 198.18.0.0/15 and *.localhost.

Fix PR: #4605. Install: npx ruflo@3.65.1 (all of latest, alpha, v3alpha point here).

Assets 2
Loading