DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54729: CVE-2026-54729: SSRF Protection Bypass in dssrf-js via NXDOMAIN Resolution Discrepancy

#security #cve #cybersecurity

CVE-2026-54729: SSRF Protection Bypass in dssrf-js via NXDOMAIN Resolution Discrepancy

Vulnerability ID: CVE-2026-54729
CVSS Score: 8.7
Published: 2026-07-31

CVE-2026-54729 is a critical Server-Side Request Forgery (SSRF) bypass vulnerability in the dssrf-js Node.js library prior to version 1.0.5. The flaw occurs because the library's DNS validation mechanism incorrectly treats domains like 'localhost' as safe when the configured upstream DNS resolver returns NXDOMAIN. Since the system's HTTP client later falls back to OS-level resolution (resolving 'localhost' to '127.0.0.1'), attackers can bypass validation and access internal loopback addresses.

TL;DR

The dssrf-js library fails to detect local/internal domains if upstream DNS servers return NXDOMAIN, allowing attackers to perform unauthenticated Server-Side Request Forgery (SSRF) to loopback endpoints.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network (AV:N)
  • CVSS Score: 8.7 (High)
  • Exploit Status: PoC
  • Impact: Integrity (High)
  • KEV Status: Not Listed

Affected Systems

  • dssrf-js (Node.js library)
  • dssrf-js: < 1.0.5 (Fixed in: 1.0.5)

Code Analysis

Commit: 668c217

Fix resolution discrepancy fallback to local lookup when direct DNS returns empty results

Exploit Details

Mitigation Strategies

  • Upgrade to dssrf-js version 1.0.5 or higher.
  • Implement network egress filtering to block connections to local and RFC 1918 addresses.
  • Deploy dedicated outbound HTTP forward proxies to intercept and validate outbound traffic.

Remediation Steps:

  1. Audit the dependency graph for vulnerable versions of 'dssrf-js'.
  2. Update package.json to require version '^1.0.5' and run 'npm install'.
  3. Configure application servers with firewall rules blocking outbound TCP to 127.0.0.0/8 and 169.254.169.254.

References

Read the full report for CVE-2026-54729 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)