Executive brief
DSSRF is a Node.js library designed to protect applications from Server-Side Request Forgery (SSRF) by verifying if a web address is safe to access. A flaw in the library's validation logic allows it to incorrectly mark dangerous internal addresses, like 'localhost', as safe when specific DNS configurations (such as Cloudflare's 1.1.1.1) are used. This could allow an attacker to bypass security checks and access sensitive internal services or data that should be protected from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the dssrf-js library due to incomplete DNS resolution logic in the 'is_url_safe' function. When the library is configured to use DNS resolvers that return NXDOMAIN for 'localhost' (such as 1.1.1.1), the 'dns.resolve4' method yields no addresses. Because the library lacked a fallback to 'dns.lookup', it failed to identify the local address and incorrectly validated the URL as safe. An attacker can exploit this to bypass SSRF protections and reach internal network services. The vulnerability was addressed in version 1.0.5 by implementing parallel resolution of A, AAAA, and CNAME records with a mandatory fallback to 'dns.lookup' when primary resolution returns no results.
Affected products
- HackingRepo dssrf-js < 1.0.5
Timeline
- 2026-06-09: patched: Fix merged in pull request 102
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: NVD publication date