SSRF Vulnerability in DSSRF Library Affects Node.js Applications
CVE-2026-54722

8.7HIGH

Key Information:

Vendor

Hackingrepo

Status
Dssrf-js
Vendor
CVE Published:
30 July 2026

What is CVE-2026-54722?

The DSSRF library, commonly used in Node.js applications, has a vulnerability that allows an attacker to evade internal IP validation. Prior to version 1.0.4, the 'is_url_safe' function incorrectly processes URLs by stripping the userinfo delimiter, which can lead to an attacker manipulating the URL to access internal services. This flaw highlights the importance of proper URL validation in web applications to prevent unauthorized access. The issue has been addressed in version 1.0.4, ensuring safer web application operations.

Affected Version(s)

dssrf-js < 1.0.4

References

https://github.com/HackingRepo/dssrf-js/security/advisori...
x_refsource_CONFIRM
https://github.com/HackingRepo/dssrf-js/issues/97
x_refsource_MISC
https://github.com/HackingRepo/dssrf-js/pull/98
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.