Is CVE-2026-44232 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44232 being exploited in the wild.

How severe is CVE-2026-44232?

High severity, with a CVSS score of 4, published 12 May 2026.

Which products and versions are affected?

HackingRepo Dssrf < 1.0.3, < 1.3.0; dssrf (npm) SEMVER:introduced=0,fixed=1.0.3.

Is there a fix for CVE-2026-44232?

Yes. dssrf (npm): upgrade to 1.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44232 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44232?

Check whether you run HackingRepo Dssrf or dssrf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44232: HackingRepo DSSRF SSRF bypass via IPv6 addresses

Q: Which products and versions are affected?

HackingRepo Dssrf < 1.0.3, < 1.3.0; dssrf (npm) SEMVER:introduced=0,fixed=1.0.3.

Q: Is there a fix for CVE-2026-44232?

Yes. dssrf (npm): upgrade to 1.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44232 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44232?

Check whether you run HackingRepo Dssrf or dssrf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44232 · Severity: high · CVSS 4 · Published 2026-05-12

The dssrf library, a tool used by developers to prevent Server-Side Request Forgery (SSRF) attacks, fails to properly validate IPv6 addresses. An attacker can bypass security checks by using various IPv6 formats to access internal services or sensitive metadata that should be restricted. This could lead to unauthorized access to internal infrastructure or private data.

Technologies: HackingRepo Dssrf. Vendors: HackingRepo, npm.

Quick answers

Is CVE-2026-44232 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44232 being exploited in the wild.
How severe is CVE-2026-44232?: High severity, with a CVSS score of 4, published 12 May 2026.
Which products and versions are affected?: HackingRepo Dssrf < 1.0.3, < 1.3.0; dssrf (npm) SEMVER:introduced=0,fixed=1.0.3.
Is there a fix for CVE-2026-44232?: Yes. dssrf (npm): upgrade to 1.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44232 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44232?: Check whether you run HackingRepo Dssrf or dssrf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dssrf (npm): upgrade to 1.0.3 or later
```
npm install dssrf@1.0.3
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the dssrf library due to incomplete filtering of IPv6 addresses in the is_url_safe function. While the library successfully blocks restricted IPv4 addresses, its IPv6 validation logic is fundamentally flawed, allowing all categories of IPv6 addresses (including loopback, link-local, ULA, and IPv4-mapped addresses) to pass as 'safe'. An attacker can exploit this by providing specially crafted IPv6 URLs to reach internal network resources or cloud metadata services (IMDS). The vulnerability is addressed in version 1.0.3.

Affected products

HackingRepo dssrf < 1.0.3

Identifiers

CVE-2026-44232
GHSA-8p33-q827-ghj5

Timeline

2026-04-27: disclosed
2026-05-06: advisory
2026-05-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.