CVE-2026-54722: HackingRepo dssrf-js SSRF bypass in is_url_safe

CVE-2026-54722 · Severity: high · CVSS 4 · Published 2026-07-30

DSSRF is a Node.js library used by developers to prevent Server-Side Request Forgery (SSRF) attacks by validating that URLs do not point to sensitive internal services. A flaw in the library's validation logic allows attackers to bypass these security checks by using specially crafted URLs containing authentication symbols. This could allow an attacker to access internal company data, cloud metadata services, or other private infrastructure that should be protected.

Technologies: HackingRepo Dssrf. Vendors: HackingRepo, npm.

Quick answers

Is CVE-2026-54722 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54722 being exploited in the wild.
How severe is CVE-2026-54722?
High severity, with a CVSS score of 4, published 30 July 2026.
Which products and versions are affected?
HackingRepo Dssrf <= 1.0.3; HackingRepo Dssrf-Js < 1.0.4; dssrf (npm) SEMVER:introduced=0,fixed=1.0.4.
Is there a fix for CVE-2026-54722?
Yes. dssrf (npm): upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54722 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54722?
Check whether you run HackingRepo Dssrf, HackingRepo Dssrf-Js or dssrf (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • dssrf (npm): upgrade to 1.0.4 or later
    npm install dssrf@1.0.4

Technical details

A Server-Side Request Forgery (SSRF) bypass exists in dssrf-js (Node.js) prior to version 1.0.4. The 'is_url_safe' and 'is_redirect_safe' functions in 'src/helpers.ts' incorrectly stripped the '@' userinfo delimiter from raw URL strings before parsing them with the WHATWG URL API. This corruption of the host/userinfo boundary allowed payloads like 'http://evil.com@127.0.0.1/' to bypass internal IP validation checks. An attacker can exploit this to reach internal services, including loopback addresses and cloud metadata endpoints (IMDS). The issue is resolved in version 1.0.4 by rejecting URLs containing non-empty username or password fields.

Affected products

  • HackingRepo dssrf-js < 1.0.4

Identifiers

  • CVE-2026-54722
  • GHSA-cg4g-m8jx-vjv2

Timeline

  • 2026-05-29: disclosed: Issue reported on GitHub
  • 2026-06-02: patched: Fix committed to repository
  • 2026-07-30: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.