GitHub Advisoryadvisory · npm
GHSA-5846-7qm3-r52j dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
HIGH
Official page ↗
- Aliases
- CVE-2026-54729
- Ecosystem
- npm
- Packages
- dssrf
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-918
- Reviewed
- 2026-07-31
Affected packages
• npm dssrf: < 1.0.5 → fixed in 1.0.5
Description
Summary
is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery.
POC
Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf:
```js
import { is_url_safe } from '../dist/helpers.js';
import dns from 'dns';
dns.setServers(['1.1.1.1']);
const TARGET = 'http://localhost/admin';
console.log(`Testing: ${TARGET}`);
console.log(`Current DNS Servers: ${dns.getServers()}`);
const result = await is_url_safe(TARGET);
if (result === true) {
console.log('dssrf treated localhost as SAFE because 1.1.1.1 returned NXDOMAIN.');
} else {
console.log('dssrf blocked localhost.');
}
```
Related
Alias · CVE (1)
- CVE-2026-54729 DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. vulnerability
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness