Executive brief
DSSRF is a Node.js library used by developers to prevent Server-Side Request Forgery (SSRF) attacks by validating that URLs do not point to sensitive internal services. A flaw in the library's validation logic allows attackers to bypass these security checks by using specially crafted URLs containing authentication symbols. This could allow an attacker to access internal company data, cloud metadata services, or other private infrastructure that should be protected.
Technical details
A Server-Side Request Forgery (SSRF) bypass exists in dssrf-js (Node.js) prior to version 1.0.4. The 'is_url_safe' and 'is_redirect_safe' functions in 'src/helpers.ts' incorrectly stripped the '@' userinfo delimiter from raw URL strings before parsing them with the WHATWG URL API. This corruption of the host/userinfo boundary allowed payloads like 'http://evil.com@127.0.0.1/' to bypass internal IP validation checks. An attacker can exploit this to reach internal services, including loopback addresses and cloud metadata endpoints (IMDS). The issue is resolved in version 1.0.4 by rejecting URLs containing non-empty username or password fields.
Affected products
- HackingRepo dssrf-js < 1.0.4
Timeline
- 2026-05-29: disclosed: Issue reported on GitHub
- 2026-06-02: patched: Fix committed to repository
- 2026-07-30: advisory: CVE published