CVE-2026-31943: 
NixOS vulnerability analysis and mitigation

CVE-2026-31943 is a Server-Side Request Forgery (SSRF) protection bypass vulnerability in LibreChat, an open-source ChatGPT-like platform. The flaw exists in the isPrivateIP() function within packages/api/src/auth/domain.ts, which fails to detect IPv4-mapped IPv6 addresses in their hex-normalized form, allowing any authenticated user to bypass SSRF protections and force the server to issue HTTP requests to internal network resources. All LibreChat versions prior to 0.8.3 are affected, including release candidates rc1 and rc2. It was published on March 27, 2026, and carries a CVSS v3.1 base score of 8.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause (CWE-918) is a normalization mismatch between LibreChat's SSRF validation layer and the Node.js URL parser. When parseDomainSpec() extracts a hostname using new URL(), Node.js silently converts IPv4-mapped IPv6 addresses from dotted-decimal form (e.g., ::ffff:169.254.169.254) to hex notation (e.g., ::ffff:a9fe:a9fe). The isPrivateIP() function only checks for the dotted-decimal form via regex, so the hex-normalized form passes validation undetected. Additionally, resolveHostnameSSRF() skips DNS resolution for any host containing :, treating it as an already-handled IPv6 literal — creating a second bypass point. Affected call sites include the agent actions creation endpoint (api/server/routes/agents/actions.js), action execution in ToolService.js, and MCP server connections in packages/api/src/mcp/connection.ts. Exploitation requires only a low-privilege authenticated account (GitHub Advisory).

Successful exploitation allows any authenticated LibreChat user to force the server to make HTTP requests to internal network resources, including cloud metadata services (AWS/GCP/Azure 169.254.169.254), loopback addresses (127.0.0.1), and RFC1918 private IP ranges. In cloud-hosted deployments, this is especially severe because the metadata endpoint is typically unauthenticated and exposes IAM credentials, instance tokens, and environment configuration that can lead to full cloud account compromise. Internal services such as databases, admin panels, and APIs not exposed to the internet are also reachable, enabling lateral movement within the internal network (GitHub Advisory).

A proof-of-concept exploit with step-by-step instructions, specific HTTP request payloads, and a Node.js verification script is publicly available in the GitHub Security Advisory (GitHub Advisory). The vulnerability requires only a low-privilege authenticated account and has low attack complexity, making it accessible to a broad range of threat actors. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.028% (0.000280), indicating a currently low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Authenticate: Obtain valid credentials for any LibreChat account with permission to create or execute agent actions.
2. Identify target internal resource: Determine the internal IP to probe — e.g., 169.254.169.254 for AWS cloud metadata, 127.0.0.1 for localhost services, or RFC1918 ranges for internal network services.
3. Craft the bypass payload: Encode the target IP as an IPv4-mapped IPv6 address in bracket notation (e.g., http://[::ffff:169.254.169.254]/). Node.js will normalize this to ::ffff:a9fe:a9fe, which bypasses the isPrivateIP() dotted-decimal regex.
4. Create a malicious agent action: Send a POST request to /api/agents/:agent_id/actions with the crafted domain as the metadata field:

POST /api/agents/:agent_id/actions
Content-Type: application/json
Authorization: Bearer <token>

{"metadata": {"domain": "http://[::ffff:169.254.169.254]/", "raw_spec": "..."}}

5. Trigger the action: Execute the agent action to cause the LibreChat server to issue an HTTP request to the internal target address.
6. Retrieve sensitive data: Collect the response, which may include cloud IAM credentials, instance metadata tokens, or data from internal services (GitHub Advisory).

• Network: Outbound HTTP requests from the LibreChat server process to 169.254.169.254, 127.0.0.1, or RFC1918 ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x); unusual connections to cloud metadata endpoints from the application host.
• Logs: LibreChat API access logs showing POST requests to /api/agents/:agent_id/actions with domain values containing [::ffff: patterns; repeated action execution requests targeting the same internal IP ranges.
• Application Behavior: Agent actions configured with domains resolving to internal or link-local addresses (e.g., ::ffff:a9fe:a9fe, ::ffff:7f00:1, ::ffff:c0a8:*, ::ffff:a00:*); unexpected HTTP responses from internal services appearing in agent action results.
• Process: Node.js process initiating TCP connections to internal network addresses not associated with normal LibreChat operation (GitHub Advisory).

Upgrade LibreChat to version 0.8.3 or later, which fixes the normalization mismatch in isPrivateIP() to correctly detect hex-normalized IPv4-mapped IPv6 addresses (GitHub Advisory). If immediate patching is not possible, restrict network-level access from the LibreChat server to cloud metadata services (block 169.254.169.254) and internal RFC1918 ranges using firewall rules or security groups. Additionally, monitor for suspicious outbound HTTP requests from the LibreChat application to internal IP ranges as a compensating control.

The vulnerability was covered by The Hacker Wire, which published an article specifically on the SSRF bypass via IPv6-mapped address confusion in LibreChat (The Hacker Wire). The advisory was also shared on Mastodon by The Hacker Wire account, generating community awareness shortly after disclosure. The vulnerability was credited to researcher b-hermes in the official GitHub Security Advisory.