diegosouzapw/OmniRoute · error · Error

SSRF guard blocked request to ${url.host} — internal/reserve

Error message

SSRF guard blocked request to ${url.host} — internal/reserved addresses are not allowed

What it means

Error "SSRF guard blocked request to ${url.host} — internal/reserved addresses are not allowed" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/memory/genericBackend.ts:243

    if (filter.limit !== undefined) out[qp.limit] = String(filter.limit);
    if (filter.offset !== undefined) out[qp.offset] = String(filter.offset);
    if (filter.orderBy) out[qp.orderBy] = filter.orderBy;
    if (filter.orderDir) out[qp.orderDir] = filter.orderDir;

    return out;
  }

  private async request<T>(
    method: string,
    path: string,
    body?: unknown,
    queryParams?: Record<string, string>
  ): Promise<T> {
    const url = new URL(path, this.config.baseUrl);

    // SSRF guard: reject requests to internal/reserved IP ranges
    if (!isValidHttpUrl(url)) {
      throw new Error(
        `SSRF guard blocked request to ${url.host} — internal/reserved addresses are not allowed`
      );
    }
    if (queryParams) {
      Object.entries(queryParams).forEach(([key, value]) => {
        url.searchParams.append(key, value);
      });
    }

    const headers: Record<string, string> = {
      "Content-Type": "application/json",
      ...this.config.headers,
    };

    if (this.config.apiKey) {
      headers["Authorization"] = `Bearer ${this.config.apiKey}`;
    }

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/memory/genericBackend.ts:243 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/1943bbbeb6c15937. Report an issue: GitHub.