{"id":"CVE-2026-54722","title":"DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks","summary":"DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the …","severity":"high","cwe":["CWE-76"],"vendor":"dssrf","product":"dssrf","affected":["dssrf <= 1.0.3"],"patched":["dssrf 1.0.4"],"published":"2026-07-30","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:12:43.783","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54722","references":[{"url":"https://github.com/HackingRepo/dssrf-js/commit/9211f91bf532433a1a1b27d946571546a63664b3","label":"security-advisories@github.com"},{"url":"https://github.com/HackingRepo/dssrf-js/issues/97","label":"security-advisories@github.com"},{"url":"https://github.com/HackingRepo/dssrf-js/pull/98","label":"security-advisories@github.com"},{"url":"https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-cg4g-m8jx-vjv2","label":"security-advisories@github.com"},{"url":"https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-cg4g-m8jx-vjv2","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-cg4g-m8jx-vjv2"}],"tags":["nvd","ghsa","npm"],"epss":0.00417,"epssPercentile":0.35661,"aliases":["GHSA-cg4g-m8jx-vjv2"],"ecosystem":"npm","ingestedAt":"2026-07-30T16:54:32.836Z","slug":"CVE-2026-54722","body":"## Overview\n\nDSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service. This issue is fixed in version 1.0.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54722)\n\nAffected packages:\n\n- `dssrf <= 1.0.3`\n\nPatched in:\n\n- `dssrf 1.0.4`\n\nSource: https://github.com/advisories/GHSA-cg4g-m8jx-vjv2","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}