Something I've never seen documented is how to actually do SSRF prevention with Node.js's fetch implementation.
Like you could resolve DNS before making the request, and assert the IP addresses are public IP addresses, but afaict, fetch() will do that too so you could theoretically get two different results (although unlikely)
Feels like Node.js should just ship an SSRF safe fetch implementation.