uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)

CRÍTICO 9.8CVE-2022-0086 · GHSA-x8rq-rc7x-5fg5 · Published 04/01/2022 · updated 17/06/2026

En resumen

CVE-2022-0086 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a uppy (transloadit), @uppy/companion.
Probabilidad de explotación en los próximos 30 días (EPSS): 1.2%, mayor que el 69.4% de las vulnerabilidades.
Solución: actualizar a 2.3.3, 3.1.5 o posterior.

Package	Affected versions	Patched versions
uppy transloadit	`< 2.3.3`	`2.3.3`
@uppy/companion npm	`< 3.1.5`	`3.1.5`

uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.

NVD description

uppy is vulnerable to Server-Side Request Forgery (SSRF)

Running one of these products? Scan your site to see whether it exposes a vulnerable version.