---
id: CVE-2026-54729
title: >-
  DSSRF is a Node.js library that provides a wide range of utilities and
  advanced SSRF defense checks
summary: >-
  DSSRF is a Node.js library that provides a wide range of utilities and
  advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localhost
  as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields
  no addres…
severity: high
cwe:
  - CWE-918
vendor: dssrf
product: dssrf
affected:
  - dssrf <= 1.0.4
patched:
  - dssrf 1.0.5
published: '2026-07-31'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:12:43.783'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54729'
references:
  - url: >-
      https://github.com/HackingRepo/dssrf-js/commit/668c21792cd1252baf779a176aa652e2b4c0067d
    label: security-advisories@github.com
  - url: 'https://github.com/HackingRepo/dssrf-js/pull/102'
    label: security-advisories@github.com
  - url: >-
      https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j
    label: security-advisories@github.com
  - url: >-
      https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-5846-7qm3-r52j'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.0048
epssPercentile: 0.38736
aliases:
  - GHSA-5846-7qm3-r52j
ecosystem: npm
ingestedAt: '2026-07-31T16:59:59.664Z'
---

## Overview

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. This issue is fixed in version 1.0.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54729)

Affected packages:

- `dssrf <= 1.0.4`

Patched in:

- `dssrf 1.0.5`

Source: https://github.com/advisories/GHSA-5846-7qm3-r52j