The isBlockedHost method is vulnerable to Server-Side Request Forgery (SSRF) because it fails to block IPv6 loopback addresses like ::1 or [::1]. The current logic checks for localhost and 127.0.0.1, but then relies on isPrivateIpAsync. However, isPrivateIpAsync explicitly returns false for loopback hosts, including IPv6 loopback addresses. This allows an attacker to bypass the host blocking and access internal services via [::1]. The suggested change explicitly blocks these IPv6 loopback addresses to prevent SSRF attacks.

  private async isBlockedHost(urlStr: string): Promise<boolean> {
    try {
      const url = new URL(urlStr);
      const hostname = url.hostname.toLowerCase();
      if (
        hostname === 'localhost' ||
        hostname === '127.0.0.1' ||
        hostname === '::1' ||
        hostname === '[::1]'
      ) {
        return true;
      }
      return await isPrivateIpAsync(urlStr);
    } catch {
      return true;
    }
  }

The application is vulnerable to DNS Rebinding because it performs a check-then-fetch pattern (Time-of-Check to Time-of-Use / TOCTOU).

1. In isBlockedHost, the hostname is resolved to its IP addresses using isPrivateIpAsync (which calls dns.promises.lookup).
2. If the resolved IP is public, isBlockedHost returns false (allowing the request).
3. Then, fetchWithTimeout or fetch is called with the original URL, which triggers a second DNS resolution to establish the connection.

An attacker can configure a malicious DNS server with a very low TTL (e.g., 0 seconds) that returns a public IP address on the first query (the check) and a private IP address (e.g., 127.0.0.1 or 10.0.0.1) on the second query (the fetch). This completely bypasses the private IP check and allows the attacker to access internal resources.

To prevent DNS rebinding, the connection must be pinned to the validated IP address. Instead of fetching the original URL, resolve the hostname once, validate the resolved IP, and then perform the fetch directly using the validated IP address while passing the original hostname in the Host header (or using a custom DNS lookup agent/hook that only returns the pre-validated IP).

Performing DNS resolution sequentially in a for...of loop for up to 20 URLs can introduce significant latency and block the agent loop, especially if some DNS queries are slow or time out.

We can optimize this by performing the DNS lookups in parallel using Promise.all before filtering the results.

  private async filterAndValidateUrls(urls: string[]): Promise<{
    toFetch: string[];
    skipped: string[];
  }> {
    const uniqueUrls = [...new Set(urls.map(normalizeUrl))];
    const validationResults = await Promise.all(
      uniqueUrls.map(async (url) => {
        const isBlocked = await this.isBlockedHost(url);
        return { url, isBlocked };
      })
    );

    const toFetch: string[] = [];
    const skipped: string[] = [];

    for (const { url, isBlocked } of validationResults) {
      if (isBlocked) {
        debugLogger.warn(
          `[WebFetchTool] Skipped private or local host: ${url}`,
        );