---
id: CVE-2026-101087
title: >-
  Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate
  user-configurable notification and DDNS webhook URLs, but the denylist did not
  cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the
  loc…
summary: >-
  Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate
  user-configurable notification and DDNS webhook URLs, but the denylist did not
  cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the
  loc…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-918
vendor: nezhahq
product: nezha
affected:
  - nezha >= 2.0.10 < 2.3.3
published: '2026-09-27'
updated: '2026-09-27'
sourceUpdated: '2026-09-27T21:17:02.587'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101087'
references:
  - url: 'https://github.com/nezhahq/nezha/commit/d1fcde8e'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/nezhahq/nezha/security/advisories/GHSA-jr2j-7hvh-h4q9'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nezha-2.0.10-through-2.3.2-ssrf-denylist-bypass-ipv6
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-27T20:58:01.540Z'
---

## Overview

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Because such addresses satisfy Go's netip.Addr.IsGlobalUnicast check, the URL validator accepted them. An authenticated user able to configure a webhook may be able to cause the dashboard to issue requests to an otherwise restricted IPv6 endpoint, but only where the dashboard's network provides unusual or non-standards-compliant routing for these transition ranges; no direct path to an IPv4 metadata, loopback, or private-network HTTP request has been demonstrated. The issue is fixed in version 2.3.3 (commit d1fcde8e), which blocks both prefixes.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.