CVE-2026-54663: swagger-typescript-api SSRF Vulnerability

CVE-2026-54663 Overview

CVE-2026-54663 is a Server-Side Request Forgery (SSRF) vulnerability in swagger-typescript-api, a code generator that produces TypeScript API clients for Fetch or Axios from OpenAPI specifications. Versions prior to 13.12.2 resolve external $ref URLs in remote schemas without validating the target, letting an attacker-controlled OpenAPI spec force the generator to issue HTTP or HTTPS requests to internal, link-local, or metadata endpoints. The flaw is tracked as [CWE-20: Improper Input Validation] and is fixed in version 13.12.2.

Critical Impact
A malicious OpenAPI specification can coerce the generator to reach internal services, bypassing network segmentation and potentially exposing cloud metadata or intranet resources.

Affected Products

swagger-typescript-api versions prior to 13.12.2
src/resolved-swagger-schema.ts (warmUpRemoteSchemasCache, fetchRemoteSchemaDocument)
Developer toolchains and CI pipelines invoking the generator against untrusted specs

Discovery Timeline

2026-07-29 - CVE-2026-54663 published to NVD
2026-07-29 - Last updated in NVD database
Fix released in swagger-typescript-api v13.12.2 (see GitHub Release v13.12.2)

Technical Details for CVE-2026-54663

Vulnerability Analysis

The generator loads OpenAPI documents and pre-resolves external references to accelerate subsequent parsing. In src/resolved-swagger-schema.ts, warmUpRemoteSchemasCache walks the input specification and collects any external $ref URLs. It then hands each URL to fetchRemoteSchemaDocument, which gates network access through isHttpUrl. That check only validates the URL scheme. It does not enforce private IP filtering, redirect restrictions, DNS rebinding protection, or same-origin controls.

Because the generator runs where a developer or build agent has network access, the attacker can reach hosts the operator can reach: internal APIs, container orchestration endpoints, cloud instance metadata services, and link-local addresses. Response content is loaded as JSON schema, so error messages and partial responses can be reflected into generated code or logs. The vulnerability requires user interaction, since a victim must run the generator against the malicious spec.

Root Cause

isHttpUrl accepts any http:// or https:// URL without validating the resolved host. There is no allow-list, no check against RFC 1918 or link-local ranges, no rebinding-safe DNS resolution, and no restriction on cross-origin redirects.

Attack Vector

An attacker publishes or supplies an OpenAPI document containing an external $ref such as http://169.254.169.254/latest/meta-data/ or http://internal.corp/admin. When a developer or CI pipeline runs swagger-typescript-api against that spec, the generator issues the outbound request from within the trusted network boundary.

typescript

// Illustrative fragment of the vulnerable pattern in
// src/resolved-swagger-schema.ts (pre-13.12.2)
// fetchRemoteSchemaDocument only checks the scheme via isHttpUrl
// before issuing the request, with no host validation:
//
//   if (isHttpUrl(url)) {
//     return fetch(url).then((r) => r.text());
//   }
//
// A malicious spec supplies:
//   { "$ref": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" }
// which the generator then fetches from the developer or CI host.

The upstream fix landed in commit 306d59a as part of Pull Request #1779 and is documented in GHSA-x36r-4347-pm5x.

Detection Methods for CVE-2026-54663

Indicators of Compromise

Outbound HTTP or HTTPS requests from developer workstations or CI runners to RFC 1918 addresses, 169.254.169.254, or fd00::/8 during swagger-typescript-api runs.
Unexpected DNS lookups for internal hostnames originating from Node.js processes executing the generator.
OpenAPI files containing external $ref values pointing to non-vendor hosts or raw IP literals.

Detection Strategies

Inventory package.json and lockfiles across repositories for swagger-typescript-api versions earlier than 13.12.2.
Instrument CI images with egress logging and alert on connections to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Pre-scan third-party OpenAPI specifications for external $ref URLs before feeding them into code generation.

Monitoring Recommendations

Correlate Node.js process telemetry with outbound network flows on build hosts to detect anomalous fetches during generation.
Track HTTP redirects from developer tooling to catch DNS rebinding or 302-based pivots into internal networks.
Enable audit logging on cloud instance metadata services (for example, IMDSv2 enforcement on AWS) and alert on unexpected callers.

How to Mitigate CVE-2026-54663

Immediate Actions Required

Upgrade swagger-typescript-api to version 13.12.2 or later across all projects, developer machines, and CI pipelines.
Treat every third-party OpenAPI document as untrusted input and review external $ref entries before generation.
Run code generation inside network-restricted build containers with no route to internal services or cloud metadata endpoints.

Patch Information

The fix is included in swagger-typescript-api v13.12.2. Details on the code changes are available in commit 306d59a and Pull Request #1779. The advisory GHSA-x36r-4347-pm5x tracks the disclosure.

Workarounds

Strip or reject external $ref URLs in OpenAPI specs before invoking the generator.
Run the generator through an egress proxy that denies RFC 1918, loopback, link-local, and cloud metadata destinations.
Enforce IMDSv2 with hop-limit 1 on cloud build hosts to blunt SSRF against instance metadata.

bash

# Upgrade swagger-typescript-api to the patched release
npm install --save-dev swagger-typescript-api@^13.12.2

# Verify the resolved version
npm ls swagger-typescript-api

# Optional: run generation inside an egress-restricted container
docker run --rm \
  --network=build-egress-only \
  -v "$PWD":/work -w /work node:20 \
  npx swagger-typescript-api -p ./openapi.yaml -o ./src/api