Go to packages list

dssrf

Ecosystem: npm

Downloads: 28.55 K

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 3HighAffects 3 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High3 (100.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 2
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting dssrf, based on data from OSV.

Vulnerabilities affecting dssrf
IDSeveritySummaryAffected versionsPublishedSource
GHSA-5846-7qm3-r52jHighdssrf: any users using 1.1.1.1 DNS is impacted by SSRF## Summary is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. ## POC Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf: ```js import { is_url_safe } from '../dist/helpers.js'; import dns from 'dns'; dns.setServers(['1.1.1.1']); const TARGET = 'http://localhost/admin'; console.log(`Testing: ${TARGET}`); console.log(`Current DNS Servers: ${dns.getServers()}`); const result = await is_url_safe(TARGET); if (result === true) { conso
  • < 1.0.5
GitHub (opens in a new tab)
GHSA-cg4g-m8jx-vjv2Highdssrf has an SSRF bypass with remove_at_symbol_in_string## Summary `is_url_safe` in v1.0.3 contains an SSRF bypass. `remove_at_symbol_in_string` is applied to the raw URL string **before** `new URL()` parses it. This strips the `@` that separates userinfo from host, corrupting the hostname so internal IPs are never checked. ## Vulnerability In `helpers.ts`, `is_url_safe` does: ```ts u = remove_at_symbol_in_string(u); // strips ALL '@' from the raw string // ... const parsed = new URL(u); const hostname = parsed.hostname; // resolved from the corrupted string ``` ### What happens step by step Input: `http://evil.com@127.0.0.1/` 1. `remov
  • < 1.0.4
GitHub (opens in a new tab)
GHSA-8p33-q827-ghj5Highdssrf: every IPv6 category bypasses is_url_safeA vulnerability on dssrf allow, an attacker to use, one of them following ipv6 ```rust Input Category http://[::1]/ IPv6 loopback http://[fc00::1]/ IPv6 ULA http://[fe80::1]/ IPv6 link-local http://[::ffff:127.0.0.1]/ IPv4-mapped loopback http://[::ffff:169.254.169.254]/ IPv4-mapped IMDS http://[::ffff:100.64.0.1]/ IPv4-mapped CGNAT http://[64:ff9b::7f00:1]/ NAT64 well-known prefix http://[64:ff9b:1::1]/ NAT64 local-use (RFC 8215) http://[5f00::1]/ SRv6 SID (RFC 9602) http://[3fff::1]/ IPv6 documentation (RFC 9637) http://[fec0::1]/ IPv6 site-local (deprecated, RFC 3879) http://[::127.0.0.1]/
  • < 1.0.3
GitHub (opens in a new tab)
  • GHSA-5846-7qm3-r52jHigh
    dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
    • < 1.0.5
    GitHub (opens in a new tab)

    ## Summary is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. ## POC Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf: ```js import { is_url_safe } from '../dist/helpers.js'; import dns from 'dns'; dns.setServers(['1.1.1.1']); const TARGET = 'http://localhost/admin'; console.log(`Testing: ${TARGET}`); console.log(`Current DNS Servers: ${dns.getServers()}`); const result = await is_url_safe(TARGET); if (result === true) { conso

    CVE: CVE-2026-54729

  • GHSA-cg4g-m8jx-vjv2High
    dssrf has an SSRF bypass with remove_at_symbol_in_string
    • < 1.0.4
    GitHub (opens in a new tab)

    ## Summary `is_url_safe` in v1.0.3 contains an SSRF bypass. `remove_at_symbol_in_string` is applied to the raw URL string **before** `new URL()` parses it. This strips the `@` that separates userinfo from host, corrupting the hostname so internal IPs are never checked. ## Vulnerability In `helpers.ts`, `is_url_safe` does: ```ts u = remove_at_symbol_in_string(u); // strips ALL '@' from the raw string // ... const parsed = new URL(u); const hostname = parsed.hostname; // resolved from the corrupted string ``` ### What happens step by step Input: `http://evil.com@127.0.0.1/` 1. `remov

    CVE: CVE-2026-54722

  • GHSA-8p33-q827-ghj5High
    dssrf: every IPv6 category bypasses is_url_safe
    • < 1.0.3
    GitHub (opens in a new tab)

    A vulnerability on dssrf allow, an attacker to use, one of them following ipv6 ```rust Input Category http://[::1]/ IPv6 loopback http://[fc00::1]/ IPv6 ULA http://[fe80::1]/ IPv6 link-local http://[::ffff:127.0.0.1]/ IPv4-mapped loopback http://[::ffff:169.254.169.254]/ IPv4-mapped IMDS http://[::ffff:100.64.0.1]/ IPv4-mapped CGNAT http://[64:ff9b::7f00:1]/ NAT64 well-known prefix http://[64:ff9b:1::1]/ NAT64 local-use (RFC 8215) http://[5f00::1]/ SRv6 SID (RFC 9602) http://[3fff::1]/ IPv6 documentation (RFC 9637) http://[fec0::1]/ IPv6 site-local (deprecated, RFC 3879) http://[::127.0.0.1]/

    CVE: CVE-2026-44232

Showing 1-3 of 3 vulnerabilities