CVE-2026-54729

Summary

dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

Severity

high

EPSS

0.5% (p41)

CWE

CWE-918

Also known as

GHSA-5846-7qm3-r52j

Published

2026-07-31

Updated

2026-07-31

Advisory details

Summary

is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery.

POC

Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf:

import { is_url_safe } from '../dist/helpers.js';
import dns from 'dns';


dns.setServers(['1.1.1.1']);

const TARGET = 'http://localhost/admin';

console.log(`Testing: ${TARGET}`);
console.log(`Current DNS Servers: ${dns.getServers()}`);

const result = await is_url_safe(TARGET);

if (result === true) {
    console.log('dssrf treated localhost as SAFE because 1.1.1.1 returned NXDOMAIN.');
} else {
    console.log('dssrf blocked localhost.');
}

References

• https://github.com/advisories/GHSA-5846-7qm3-r52j
• https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j
• https://github.com/HackingRepo/dssrf-js/pull/102
• https://github.com/HackingRepo/dssrf-js/commit/668c21792cd1252baf779a176aa652e2b4c0067d

Related advisories

• CVE-2026-54722 — high · npm/dssrf
• CVE-2026-77524 — critical · Go/github.com/kedacore/keda
• GHSA-jqmf-mx4f-hfr6 — critical · PyPI/vibe-trading-ai
• CVE-2026-61559 — critical · npm/@zereight/mcp-gitlab
• CVE-2026-75856 — critical · crates.io/deepseek-tui
• CVE-2026-71428 — critical · PyPI/unstructured
• CVE-2026-64849 — critical · PyPI/mlflow
• CVE-2026-73080 — critical · Go/github.com/seaweedfs/seaweedfs

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity