CVE-2026-77866: Slab safeurl SSRF Vulnerability

CVE-2026-77866 Overview

CVE-2026-77866 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-636] in the Slab safeurl Elixir library. The library exists to block requests to reserved and internal network destinations. However, its validation only compares IPv4 addresses against the reserved ranges and blocklist. An attacker who controls a URL passed to safeurl can reach blocked internal destinations by expressing them as IPv6 addresses or as hostnames that resolve to no IPv4 address. Deployments using an allowlist are not affected because unmatched addresses are rejected by default in that mode. The issue affects safeurl from version 0.1.0 onward.

Critical Impact
Applications relying on safeurl blocklist mode can be coerced into issuing HTTP requests to internal services, cloud metadata endpoints, and other restricted network destinations.

Affected Products

Slab safeurl (Elixir library) from version 0.1.0 onward
Elixir applications using safeurl in blocklist mode
Downstream services accepting user-controlled URLs validated by safeurl

Discovery Timeline

2026-09-15 - CVE CVE-2026-77866 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77866

Vulnerability Analysis

The safeurl library is designed to mitigate SSRF by rejecting URLs that resolve to private or reserved IP ranges. The address validation logic only evaluates IPv4 candidates against the blocklist. Any address that is not an IPv4 literal is treated as matching nothing. When the library is configured in blocklist mode, an unmatched address is accepted and the outbound HTTP request proceeds.

This behavior turns three distinct classes of destinations into bypasses. An IPv4 target such as 127.0.0.1, rejected as expected, can be reached by expressing the same host as an IPv6 loopback ([::1]) or an IPv4-mapped IPv6 address. IPv6 entries added to the blocklist are never matched. A hostname that resolves to only AAAA records, or to no IPv4 record at all, passes the check regardless of where it points.

The SSRF primitive allows attackers to pivot from public-facing Elixir services to internal HTTP endpoints, including instance metadata services, orchestration APIs, and administrative interfaces.

Root Cause

The root cause is incomplete address-family handling in the blocklist enforcement path. The check assumes every candidate address is IPv4 and defaults to "allow" when the assumption fails. Allowlist mode inverts this default, which is why allowlist deployments are not affected.

Attack Vector

Exploitation requires an application feature that accepts a user-supplied URL and passes it to safeurl for validation before issuing an HTTP request. The attacker submits a URL whose host is an IPv6 literal, an IPv4-mapped IPv6 address, or a hostname engineered to resolve exclusively to IPv6. The library approves the request, and the server-side HTTP client contacts the internal destination.

The realCodeExamples supplied for this CVE are the initial license and module docstring for the library and do not illustrate the vulnerable code path. See the GitHub commit for safeurl-elixir and the CNA advisory for the corrective changes.

Detection Methods for CVE-2026-77866

Indicators of Compromise

Outbound HTTP requests from Elixir application hosts to link-local addresses such as 169.254.169.254 reached via IPv6 or mapped forms.
Application logs showing user-supplied URLs containing IPv6 literals in brackets (for example http://[::1]/) or IPv4-mapped forms (::ffff:127.0.0.1).
DNS resolutions from application hosts to attacker-controlled domains returning only AAAA records.

Detection Strategies

Inspect HTTP request logs from services that use safeurl for destinations inside RFC1918, loopback, or cloud metadata ranges expressed in IPv6 form.
Alert on any request from a public-facing web tier to internal management endpoints not part of its documented dependency graph.
Review application code for calls to SafeURL.get/2 and related functions where the URL originates from an untrusted parameter.

Monitoring Recommendations

Forward outbound proxy and egress firewall telemetry to a central data store and correlate on internal-destination anomalies.
Enable DNS query logging on application hosts and flag domains that return AAAA records but no A records when queried by web workers.
Monitor for metadata service access patterns from workloads that have no legitimate need to call them.

How to Mitigate CVE-2026-77866

Immediate Actions Required

Upgrade safeurl to the fixed release referenced in the CNA advisory as soon as it is available for your dependency channel.
Audit application code paths that pass user-controlled URLs to safeurl and restrict the accepted URL schemes and hosts.
Where feasible, switch configuration from blocklist mode to allowlist mode, since allowlist deployments are not affected.

Patch Information

The upstream fix is tracked in the safeurl-elixir repository commit and referenced by OSV entry EEF-CVE-2026-77866. Update mix.exs to require the patched version and run mix deps.update safeurl followed by a redeploy.

Workarounds

Configure the HTTP client (for example HTTPoison or the underlying hackney pool) to disable IPv6 resolution for user-driven request paths.
Enforce egress filtering at the network layer to block traffic from application subnets to RFC1918, loopback, and cloud metadata ranges over both IPv4 and IPv6.
Reject URLs at the application layer when the host is an IPv6 literal or an IPv4-mapped IPv6 address until the library patch is deployed.

bash

# Configuration example: pin the patched safeurl release in mix.exs
# {:safeurl, "~> X.Y.Z"}  # replace X.Y.Z with the fixed version from the advisory
mix deps.update safeurl
mix deps.get
mix compile --force