CVE-2026-54722

Name of the Vulnerable Software and Affected Versions DSSRF versions prior to 1.0.4

Description An SSRF bypass exists in the is url safe() function within src/helpers.ts. The issue occurs because the remove at symbol in string() function strips the @ delimiter from the raw URL string before the new URL() constructor parses it. Since the @ symbol separates user information from the host, removing it corrupts the hostname, allowing attacker-controlled URLs to bypass internal IP validation. Consequently, a client using the original URL may reach internal services, including internal IPv4 ranges, IPv6 loopback, and AWS IMDS.

Recommendations Update DSSRF to version 1.0.4.