DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54722: CVE-2026-54722: Server-Side Request Forgery (SSRF) Bypass via Userinfo Stripping in dssrf-js

#security #cve #cybersecurity

CVE-2026-54722: Server-Side Request Forgery (SSRF) Bypass via Userinfo Stripping in dssrf-js

Vulnerability ID: CVE-2026-54722
CVSS Score: 8.7
Published: 2026-07-30

An SSRF validation bypass exists in dssrf-js (v1.0.3 and prior) due to an improper string normalization sequence inside is_url_safe. Before validating the host using Node's WHATWG parser, the helper strips the '@' symbol. This corrupts the parser's authority resolution, while the application's client requests the original, un-sanitized string containing internal IP targets.

TL;DR

The dssrf-js library before 1.0.4 strips the '@' character from URLs during safety validation. This causes the library to validate a safe, mutated host string (e.g., evil.com127.0.0.1) while the downstream client retrieves the original URL, connecting directly to restricted local resources.

Technical Details

  • CWE ID: CWE-76: Improper Neutralization of Equivalent Special Elements
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 8.7
  • EPSS Score: N/A (New 2026 Vulnerability)
  • Impact: High Integrity Compromise (VI:H)
  • Exploit Status: None (No active public exploits cataloged)
  • KEV Status: False

Affected Systems

  • HackingRepo/dssrf-js
  • dssrf-js: < 1.0.4 (Fixed in: 1.0.4)

Code Analysis

Commit: 9211f91

Fix critical security bug with remove_at_symbol_in_string

Mitigation Strategies

  • Upgrade the dssrf-js dependency to version 1.0.4 or higher.
  • Implement application-level sanitation to reject URLs containing userinfo sequences before validation.
  • Establish strict egress firewall filtering to block requests targeting local subnets and loopback scopes.

Remediation Steps:

  1. Navigate to the application root directory containing package.json.
  2. Execute 'npm install dssrf-js@1.0.4' to upgrade the package version.
  3. Verify that all test cases evaluating internal IP ranges continue to block SSRF requests successfully.

References

Read the full report for CVE-2026-54722 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)