mcp-fetch's SSRF guard skipped every private-address check on bracketed IPv6 (CVE-2026-80347, CVSS 8.7).

NVD published this against kazuph/mcp-fetch through 1.6.3 on August 26. isSafeUrl reads the hostname from the parsed URL, which for http://[::1]/ yields the bracketed string, then tests it with net.isIP, which returns zero for a bracketed value. The entire private-address branch is skipped, DNS resolution of the bracketed string returns nothing, and the target is declared safe before the HTTP client strips the brackets and connects (NVD). Because the address can be given in IPv4-mapped ::ffff: form, this reaches any IPv4 target the loopback checks existed to block, including cloud metadata endpoints. The fetch URL is a tool argument, so prompt injection is a sufficient trigger. Anyone writing an SSRF guard should test the bracketed form specifically.