CVE-2026-54722

Received Received - Intake

DSSRF Library URL Parsing Bypass via @ Symbol

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service. This issue is fixed in version 1.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-54722

EUVD

EUVD-2026-51232

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-76	The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

Attack-Flow Graph

Executive Summary

DSSRF is a Node.js library with SSRF defense checks. Before version 1.0.4, the is_url_safe function in src/helpers.ts removed the @ symbol from URLs before validation. This allowed attackers to bypass internal-IP checks by crafting URLs that would reach internal services.

Detection Guidance

This vulnerability affects the DSSRF Node.js library versions prior to 1.0.4. To detect it, check the installed version of the library in your project using commands like 'npm list dssrf' or inspect package.json. If the version is below 1.0.4, the system is vulnerable.

Impact Analysis

An attacker could exploit this to send requests to internal services from your application. This could lead to unauthorized access to internal systems, data exfiltration, or further attacks against your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations.

Mitigation Strategies

Update the DSSRF library to version 1.0.4 or later to address the SSRF bypass vulnerability.

Hi! I’m here to help you understand CVE-2026-54722. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70