The DSSRF library, prior to version 1.0.5, contains a vulnerability that allows server-side request forgery (SSRF) due to improper handling of localhost by the is_url_safe function. This issue arises when the DNS resolver 1.1.1.1 returns NXDOMAIN, causing dns.resolve4 to yield no address and preventing a dns.lookup fallback. As a result, localhost can be treated as safe, enabling SSRF attacks. The vulnera [truncated]
A vulnerability in the DSSRF Node.js library prior to version 1.0.4 allows an attacker to bypass internal-IP validation, potentially leading to unauthorized access to internal services. The issue is fixed in version 1.0.4. This vulnerability could allow attackers to access internal services, emphasizing the need for defenders to assess exposure and update to version 1.0.4 or later. The DSSRF library's vul [truncated]
CVE-2026-44232 is a high-severity SSRF defense bypass in the Node.js library dssrf-js. According to the public advisory, versions before 1.3.0 allow every IPv6 category to bypass the is_url_safe check. The issue is fixed in 1.3.0. The NVD record lists the vulnerability as Deferred and references the GitHub security advisory.
