CVE-2026-129094

The @utcp/http library, prior to version 1.1.14 , is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a failure to properly validate the {host} placeholder in call templates, allowing remote manuals to bypass remote-loopback checks. An attacker can supply host arguments such...

CVE-2026-101061

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

CVE-2026-101061: Server-Side Request Forgery (SSRF)

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...