CVE-2026-54722 Details
Description
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service. This issue is fixed in version 1.0.4.
A vulnerability in the DSSRF Node.js library, prior to version 1.0.4, allows for server-side request forgery (SSRF) bypass. The issue arises in the 'is_url_safe' function, where the 'remove_at_symbol_in_string' helper strips the '@' userinfo delimiter before the URL is parsed. This manipulation enables an attacker-controlled URL to bypass internal IP validation, causing the client to reach an internal service. The vulnerability is exploited by crafting a URL that, after stripping the userinfo, resolves to a valid public IP, while the original URL points to a private IP or internal service.
Users are advised to upgrade to DSSRF version 1.0.4, which removes the userinfo stripping and implements a proper check after parsing the URL.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-cg4g-m8jx-vjv2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/HackingRepo/dssrf-js/commit/9211f91bf532433a1a1b27d946571546a63664b3 | [email protected] | Source Code |
| https://github.com/HackingRepo/dssrf-js/issues/97 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/HackingRepo/dssrf-js/pull/98 | [email protected] | Issue TrackingVendor |
| https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-cg4g-m8jx-vjv2 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-76 | Improper Neutralization of Equivalent Special Elements | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HackingRepo DSSRF | <= 1.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |