20 matches found
CVE-2026-54729 dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...
GHSA-5846-7QM3-R52J dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
Summary isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. POC Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf: js import isurlsafe from...
NPM: dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
NPM: dssrf: any users using 1.1.1.1 DNS is impacted by SSRF vulnerability discovered by ? in WordPress Npm dssrf versions = 1.0.4...
CVE-2026-54729: Server-Side Request Forgery (SSRF)
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...
CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-54722
DSSRF (Node.js library) has a vulnerability in is_url_safe prior to version 1.0.4. The bug arises because is_url_safe strips the @ userinfo delimiter via remove_at_symbol_in_string before parsing URLs, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using t...
CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
NPM: dssrf has an SSRF bypass with remove_at_symbol_in_string
NPM: dssrf has an SSRF bypass with removeatsymbolinstring vulnerability discovered by ? in WordPress Npm dssrf versions = 1.0.3...
PT-2026-66529
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is url safe in src/helpers.ts strips the @ userinfo delimiter with remove at symbol in string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-...
CVE-2026-54722: Improper Neutralization of Equivalent Special Elements
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-44232
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.3.0, every IPv6 category bypasses isurlsafe. This vulnerability is fixed in 1.3.0...
CVE-2026-44232
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses isurlsafe. This vulnerability is fixed in 1.0.3...
@mappies/miniwat-mcp-web (>=0.1.0, <=0.5.0) potentially affected by CVE-2026-44232 via dssrf (1.0.6)
dssrf NPM version 1.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on dssrf and may be impacted: - @mappies/miniwat-mcp-web =0.1.0, =0.5.0 Source cves: CVE-2026-44232 Source advisory: MEND:CVE-2026-44232...
CVE-2026-44232 dssrf: every IPv6 category bypasses is_url_safe
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses isurlsafe. This vulnerability is fixed in 1.0.3...
CVE-2026-44232
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses isurlsafe. This vulnerability is fixed in 1.0.3...
CVE-2026-44232 dssrf: every IPv6 category bypasses is_url_safe
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses isurlsafe. This vulnerability is fixed in 1.0.3...
CVE-2026-44232: Incomplete Filtering of Special Elements
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses isurlsafe. This vulnerability is fixed in 1.0.3...
dssrf: every IPv6 category bypasses is_url_safe
A vulnerability on dssrf allow, an attacker to use, one of them following ipv6 rust Input Category http://::1/ IPv6 loopback http://fc00::1/ IPv6 ULA http://fe80::1/ IPv6 link-local http://::ffff:127.0.0.1/ IPv4-mapped loopback http://::ffff:169.254.169.254/ IPv4-mapped IMDS...
@mappies/miniwat-mcp-web (>=0.1.0, <=0.5.0) potentially affected by CVE-2026-44232 via dssrf (1.0.6)
dssrf NPM version 1.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on dssrf and may be impacted: - @mappies/miniwat-mcp-web =0.1.0, =0.5.0 Source cves: CVE-2026-44232 Source advisory: SNYK:JS-DSSRF-16636451...
GHSA-8P33-Q827-GHJ5 dssrf: every IPv6 category bypasses is_url_safe
A vulnerability on dssrf allow, an attacker to use, one of them following ipv6 rust Input Category http://::1/ IPv6 loopback http://fc00::1/ IPv6 ULA http://fe80::1/ IPv6 link-local http://::ffff:127.0.0.1/ IPv4-mapped loopback http://::ffff:169.254.169.254/ IPv4-mapped IMDS...