ssrf
Safeguard articles tagged "ssrf" — guides, analysis, and best practices for software supply chain and application security.
46 articles
CVE-2023-26159: SSRF/credential exposure in follow-redire...
CVE-2023-26159 shows how flawed URL parsing in follow-redirects let attackers trigger SSRF and leak Authorization headers across unintended hosts.
Pandoc CVE-2025-51591: SSRF Against EC2 Metadata in the Wild
Wiz documented active exploitation of Pandoc CVE-2025-51591 to reach the AWS IMDS through iframe rendering. Here is the kill chain and the production controls that contained it.
SSRF Meaning: What Server-Side Request Forgery Is and How to Stop It
SSRF stands for Server-Side Request Forgery, a vulnerability where an attacker tricks your server into making requests on their behalf. Here is what it means, why it is dangerous, and how to defend against it.
superagent npm: Security Review and Safe HTTP Requests
SuperAgent is a mature HTTP client for Node.js, but old versions carry prototype pollution and information-exposure flaws. Here is a practical security review.
AWS Breach: How They Actually Happen and How to Prevent One
Most AWS breaches are not AWS failing — they are misconfiguration, leaked keys, and over-privileged roles. Here is how the real ones unfolded and how to stop yours.
Validating URLs Safely in Python with the validators Library
The Python validators library's url validator is a quick way to check URLs, but older regex-based versions carried a ReDoS risk. Here's how to use it safely.
Securing Next.js applications and middleware
CVE-2025-29927 let attackers bypass Next.js middleware auth with one header. Here's how that and three other real CVEs expose middleware, Server Actions, and caching.
WWW XXE: Understanding and Preventing XML External Entity Attacks
XXE lets a crafted XML document read files, reach internal services, and exhaust resources. Here is how the attack works and how to shut it down.
How to Build a Secure Python URL Validator (and Avoid SSRF)
A Python URL validator has to do more than match a regex. Here is how to validate URLs safely, block SSRF, and pick between urllib, validators, and Pydantic.
Python: Check If a String Is a Valid URL (Safely)
How to check if a string is a URL in Python using urllib.parse, when to add validators, and why parseable does not mean safe for the URL you are about to fetch.
npm install axios: A Security Review and Safe Usage Guide
Running npm install axios is safe today, but the version you pin matters. Here is a look at the CVEs that have hit axios and how to use it without leaking credentials.
Puppeteer on npm: A Security Review and Safe Usage Guide
puppeteer npm installs a library that drives a real headless Chrome. That power brings real risks — install scripts, SSRF, and a browser-sized attack surface. Here is how to use it safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.