CVE-2026-54722 in dssrf-js
Summary
by MITRE • 07/30/2026
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service. This issue is fixed in version 1.0.4.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in the DSSRF Node.js library represents a critical server-side request forgery weakness that undermines the library's core security functionality. This flaw specifically affects versions prior to 1.0.4 where the is_url_safe function in src/helpers.ts demonstrates improper URL parsing logic that can be exploited by attackers to bypass internal IP validation mechanisms. The vulnerability stems from the library's handling of URL userinfo components, particularly the @ symbol delimiter that separates user credentials from host information in URLs.
The technical implementation flaw occurs when the remove_at_symbol_in_string function processes attacker-controlled input before URL parsing takes place. This premature stripping of the @ symbol effectively removes a critical component that should be preserved during validation checks, allowing malicious actors to craft URLs that appear legitimate to the security validation logic while actually directing requests to internal network services. The vulnerability creates a path where an attacker can manipulate URL structures to bypass the intended security boundaries designed to prevent access to internal resources.
This issue directly impacts the operational security posture of applications relying on DSSRF for SSRF protection, as it enables attackers to potentially access internal services that should remain isolated from external networks. The bypass mechanism specifically targets internal IP validation checks, meaning that even when proper security measures are in place to restrict access to internal network resources, the vulnerability allows adversaries to circumvent these protections through carefully crafted URL manipulation.
The fix implemented in version 1.0.4 addresses this by ensuring proper handling of userinfo delimiters during URL processing, maintaining the integrity of the @ symbol throughout the validation process. This correction prevents the premature removal that previously enabled bypass attempts and restores the intended security controls for internal IP validation.
From a cybersecurity perspective, this vulnerability aligns with CWE-918, which covers server-side request forgery vulnerabilities, and maps to ATT&CK technique T1190 for exploitation of remote services. The flaw demonstrates how seemingly minor parsing logic errors can create significant security weaknesses in defense mechanisms designed to protect against internal network access attempts.
Organizations using vulnerable versions of DSSRF should immediately update to version 1.0.4 or later to mitigate this risk, as the vulnerability could enable attackers to perform unauthorized access to internal systems that would normally be protected by network segmentation controls. The remediation involves ensuring proper URL parsing order and maintaining all userinfo components during security validation checks to prevent manipulation of authentication information that could otherwise bypass intended access controls.
This incident underscores the importance of careful URL handling in security libraries, particularly when dealing with authentication components and network boundary enforcement. The vulnerability demonstrates how improper sequence of operations in URL processing can create security artifacts that allow attackers to subvert intended protection mechanisms, highlighting the need for comprehensive testing of security validation logic against various input manipulation scenarios.
The fix represents a crucial defensive measure that restores proper parsing behavior and ensures that userinfo delimiters are preserved during validation processes, thereby maintaining the integrity of internal IP address restrictions that form a fundamental part of network security architectures. This correction helps ensure that applications using DSSRF maintain appropriate isolation between external and internal network components as intended by the library's security design principles.