# CVE-2026-54729: HackingRepo dssrf-js SSRF bypass via DNS resolver inconsistency

Source: https://junglewise.ai/threats/cve-2026-54729-hackingrepo-dssrf-js-ssrf-bypass-via-dns-resolver-inconsistency  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54729 · Severity: high · CVSS 4 · Published 2026-07-31

dssrf is a Node.js library that protects applications against server-side request forgery (SSRF) attacks. When using the popular 1.1.1.1 DNS resolver, dssrf incorrectly allows requests to localhost and other private addresses because it only relies on dns.resolve4() without a fallback mechanism. This allows attackers to bypass SSRF protections and access restricted internal services.

Technologies: [HackingRepo Dssrf](https://junglewise.ai/threats/technologies/dssrf). Vendors: [HackingRepo](https://junglewise.ai/threats/vendors/hackingrepo).

## Quick answers

**Is CVE-2026-54729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54729 being exploited in the wild.

**How severe is CVE-2026-54729?** High severity, with a CVSS score of 4, published 31 July 2026.

**Which products and versions are affected?** HackingRepo Dssrf <= 1.0.4, <=1.0.4; HackingRepo Dssrf-Js < 1.0.5.

**Is there a fix for CVE-2026-54729?** A patch was published on 2026-06-09: Fix released in version 1.0.5 via PR #102 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54729 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54729?** Check whether you run HackingRepo Dssrf or HackingRepo Dssrf-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the is_url_safe() helper function in dssrf versions ≤1.0.4. The function relies solely on dns.resolve4() for address resolution; when the configured DNS resolver (such as 1.1.1.1) returns NXDOMAIN for a localhost or private address query, dns.resolve4() yields no results and the function lacks a fallback to dns.lookup(). This causes the validation to incorrectly treat the request as safe when it should be blocked. An unauthenticated attacker on the network can exploit this by making the vulnerable application fetch internal resources via SSRF. The fix (version 1.0.5+) implements a fallback mechanism to dns.lookup() when dns.resolve4()/resolve6() return empty results, ensuring proper validation regardless of DNS resolver behavior.

## Affected products

- HackingRepo dssrf <=1.0.4

## Identifiers

- CVE-2026-54729
- GHSA-5846-7qm3-r52j

## Timeline

- 2026-07-31: disclosed: Advisory GHSA-5846-7qm3-r52j published on GitHub
- 2026-06-09: patched: Fix released in version 1.0.5 via PR #102

## References

- [https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j](https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j)
- [https://github.com/HackingRepo/dssrf-js/pull/102](https://github.com/HackingRepo/dssrf-js/pull/102)
- [https://github.com/HackingRepo/dssrf-js/commit/668c21792cd1252baf779a176aa652e2b4c0067d](https://github.com/HackingRepo/dssrf-js/commit/668c21792cd1252baf779a176aa652e2b4c0067d)
- [https://github.com/HackingRepo/dssrf-js](https://github.com/HackingRepo/dssrf-js)

## Related threats

- [HackingRepo dssrf-js SSRF bypass in is_url_safe](https://junglewise.ai/threats/cve-2026-54722-hackingrepo-dssrf-js-ssrf-bypass-in-is-url-safe)
- [HackingRepo DSSRF SSRF bypass via IPv6 addresses](https://junglewise.ai/threats/cve-2026-44232-hackingrepo-dssrf-ssrf-bypass-via-ipv6-addresses)