CVE-2026-54729: CWE-918: Server-Side Request Forgery (SSRF) in HackingRepo dssrf-js
## Summary is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. ## POC Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf: ```js import { is_url_safe } from '../dist/helpers.js'; import dns from 'dns'; dns.setServers(['1.1.1.1']); const TARGET = 'http://localhost/admin'; console.log(`Testing: ${TARGET}`); console.log(`Current DNS Servers: ${dns.getServers()}`); const result = await is_url_safe(TARGET); if (result === true) { console.log('dssrf treated localhost as SAFE because 1.1.1.1 returned NXDOMAIN.'); } else { console.log('dssrf blocked localhost.'); } ```
AI Analysis
Technical Summary
The vulnerability in dssrf-js (CVE-2026-54729) arises because the is_url_safe function can mistakenly consider localhost addresses safe when the DNS resolver 1.1.1.1 returns NXDOMAIN. This happens because dns.resolve4 yields no address and no fallback to dns.lookup occurs, enabling an attacker to exploit SSRF by bypassing intended protections. The problem is resolved in dssrf-js version 1.0.5.
Potential Impact
An attacker can exploit this vulnerability to perform server-side request forgery, potentially causing the server to make unauthorized requests to internal or localhost resources. This can lead to unauthorized access or information disclosure within the affected environment.
Mitigation Recommendations
Upgrade dssrf-js to version 1.0.5 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade from the vendor's repository or package manager. Patch status is not yet confirmed via vendor advisory; check the vendor's official sources for current remediation guidance.
CVE-2026-54729: CWE-918: Server-Side Request Forgery (SSRF) in HackingRepo dssrf-js
Description
## Summary is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. ## POC Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf: ```js import { is_url_safe } from '../dist/helpers.js'; import dns from 'dns'; dns.setServers(['1.1.1.1']); const TARGET = 'http://localhost/admin'; console.log(`Testing: ${TARGET}`); console.log(`Current DNS Servers: ${dns.getServers()}`); const result = await is_url_safe(TARGET); if (result === true) { console.log('dssrf treated localhost as SAFE because 1.1.1.1 returned NXDOMAIN.'); } else { console.log('dssrf blocked localhost.'); } ```
CVSS v4.0
Score 8.7high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in dssrf-js (CVE-2026-54729) arises because the is_url_safe function can mistakenly consider localhost addresses safe when the DNS resolver 1.1.1.1 returns NXDOMAIN. This happens because dns.resolve4 yields no address and no fallback to dns.lookup occurs, enabling an attacker to exploit SSRF by bypassing intended protections. The problem is resolved in dssrf-js version 1.0.5.
Potential Impact
An attacker can exploit this vulnerability to perform server-side request forgery, potentially causing the server to make unauthorized requests to internal or localhost resources. This can lead to unauthorized access or information disclosure within the affected environment.
Mitigation Recommendations
Upgrade dssrf-js to version 1.0.5 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade from the vendor's repository or package manager. Patch status is not yet confirmed via vendor advisory; check the vendor's official sources for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T23:07:33.232Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6cf74dbf32cb7a34294aec
Added to database: 07/31/2026, 19:28:13 UTC
Last enriched: 07/31/2026, 19:37:39 UTC
Last updated: 07/31/2026, 21:28:23 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.