Server-Side Request Forgery Vulnerability in DSSRF Node.js Library
CVE-2026-54729

8.7HIGH

Key Information:

Vendor

Hackingrepo

Status
Dssrf-js
Vendor
CVE Published:
31 July 2026

What is CVE-2026-54729?

A vulnerability has been identified in the DSSRF Node.js library, where the function is_url_safe improperly considers localhost as a safe option. This occurs when the configured DNS resolver, 1.1.1.1, returns NXDOMAIN, leading to potential server-side request forgery attacks due to the absence of an address from dns.resolve4 and the lack of a fallback from dns.lookup. The issue has been corrected in version 1.0.5, which enhances the security posture of applications utilizing this library.

Affected Version(s)

dssrf-js < 1.0.5

References

https://github.com/HackingRepo/dssrf-js/security/advisori...
x_refsource_CONFIRM
https://github.com/HackingRepo/dssrf-js/pull/102
x_refsource_MISC
https://github.com/HackingRepo/dssrf-js/commit/668c21792c...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.