---
id: CVE-2026-110254
title: >-
  Finsys Dockhand before 1.0.45 contains a server-side request forgery
  vulnerability in the ipCategory() function in src/lib/server/url-safety.ts,
  which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges
summary: >-
  Finsys Dockhand before 1.0.45 contains a server-side request forgery
  vulnerability in the ipCategory() function in src/lib/server/url-safety.ts,
  which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges.
  Authenticated attackers…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-918
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T19:30:29.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110254'
references:
  - url: 'https://github.com/Finsys/dockhand/security/advisories/GHSA-8rv7-48hx-jfw9'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/dockhand-before-1.0.45-ssrf-via-ipv6-transition-address-bypass-in-ipcategory
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T19:43:28.945Z'
---

## Overview

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.