CVE-2026-54729

HighCVSS 8.7

Published: 31/07/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

22th percentile - higher than 22% of all known CVEs

Summary

In DSSRF before 1.0.5, is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing SSRF.

Risk Assessment

Risk of server-side request forgery to internal resources, potentially leading to data leakage or further attacks.

Recommendation

Update DSSRF to version 1.0.5 or later.

Other vulnerabilities in DSSRF

CVE-2026-54722High
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service.

Original NVD description (English source)

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. This issue is fixed in version 1.0.5.