Listen to this Post
How CVE-2026-54729 Works
The DSSRF library is a Node.js package designed to provide robust, deterministic protections against Server-Side Request Forgery (SSRF) attacks. Its primary function, is_url_safe, is intended to validate URLs and block any requests to internal or private network resources. This validation involves a multi-step process, including DNS resolution to determine the actual IP address of a given hostname.
The vulnerability, tracked as CVE-2026-54729, exists in versions of `dssrf-js` prior to 1.0.5. The core of the issue lies within the `resolve_all_records` helper function, located in src/helpers.ts. This function is responsible for resolving a hostname to its IP addresses. Before the patch, it exclusively used `dns.resolve4` (and dns.resolve6) to perform its DNS lookups.
The `dns.resolve4` method in Node.js performs a DNS resolution by querying the system’s configured DNS servers directly. This process does not consult the operating system’s local hosts file (/etc/hosts on Linux/macOS, `C:\Windows\System32\drivers\etc\hosts` on Windows). When a user configures their system to use a public DNS resolver like Cloudflare’s 1.1.1.1, the DNS query for a hostname like `localhost` will fail because `1.1.1.1` is an authoritative recursive resolver that does not have a record for localhost. Consequently, the DNS server returns an `NXDOMAIN` (Non-Existent Domain) response.
In the vulnerable code, when `dns.resolve4` receives an `NXDOMAIN` response, it yields no IP addresses (an empty array). Critically, the `resolve_all_records` function lacked a fallback mechanism, such as dns.lookup. The `dns.lookup` method uses the operating system’s name resolution, which does consult the hosts file and would correctly resolve `localhost` to the loopback address 127.0.0.1.
Because `resolve_all_records` returned an empty list of IPs for localhost, the calling function, is_hostname_resolve_to_internal_ip, was fed incorrect information. With no IP addresses to evaluate, this function failed to identify `localhost` as an internal, unsafe destination. This failure cascaded up to the main `is_url_safe` function, which was then tricked into treating the URL as safe. An attacker could exploit this by supplying a URL pointing to http://localhost/admin` or other internal services, effectively bypassing the SSRF protection and allowing the server to make unauthorized requests to internal resources. The issue was resolved in version 1.0.5 by adding a fallback to `dns.lookup` when `dns.resolve4` returns no addresses.dns.lookup
<h2 style="color: blue;">DailyCVE Form</h2>
Platform: dssrf-js Node.js
Version: < 1.0.5
Vulnerability: Server-Side Request Forgery
Severity: HIGH (CVSS: 8.7)
date: July 31, 2026
<h2 style="color: blue;">Prediction: August 1, 2026</h2>
<h2 style="color: blue;">What Undercode Say</h2>
The vulnerability is caused by a flawed DNS resolution process in the `resolve_all_records` function, which only uses `dns.resolve4` and lacks a fallback to. This is a classic example of how improper error handling in security-critical functions can lead to a complete bypass of protections.
To check if your application is vulnerable, you can simulate the behavior by configuring your system to use the `1.1.1.1` DNS resolver and running the following Node.js code snippet:
const dns = require('dns');
// This mimics the vulnerable behavior of dns.resolve4
dns.resolve4('localhost', (err, addresses) => {
console.log('dns.resolve4 result:', addresses); // Output: undefined or empty array
});
// This is the missing fallback that would have prevented the issue
dns.lookup('localhost', (err, address, family) => {
console.log('dns.lookup result:', address); // Output: 127.0.0.1
});
The code shows that `dns.resolve4` fails to resolve `localhost` when using1.1.1.1, while `dns.lookup` correctly resolves it. The absence of this fallback is the root cause.1.1.1.1
<h2 style="color: blue;">Exploit</h2>
An attacker can exploit this vulnerability by providing a URL that points to an internal service, such as `http://localhost:8080/admin` or `http://169.254.169.254/latest/meta-data/` (a common target for cloud metadata services). Because the vulnerable `is_url_safe` function would incorrectly mark these URLs as safe, the application would proceed to make the request, allowing the attacker to access internal resources, read sensitive data, or pivot to other internal systems.
A simple proof-of-concept would be to call the vulnerable `is_url_safe` function with a localhost URL while the system's DNS is set to:
const { is_url_safe } = require('dssrf');
// This would incorrectly return true (safe) in vulnerable versions
const isSafe = is_url_safe('http://localhost/admin');
console.log('Is URL safe?', isSafe); // true (vulnerable)
<h2 style="color: blue;">Protection</h2>
The primary and most effective protection is to update the `dssrf-js` library to version 1.0.5 or later. This version includes the fix that adds a fallback todns.lookup`, ensuring that local hostnames like `localhost` are correctly identified as internal and unsafe.
If an immediate update is not possible, a workaround is to avoid using public DNS resolvers like `1.1.1.1` for the application’s environment. Using a DNS resolver that can resolve `localhost` (or ensuring the system’s hosts file is consulted) would mitigate this specific attack vector. However, updating the library is the recommended and most comprehensive solution.
Impact
The impact of this vulnerability is High. Successful exploitation allows for Server-Side Request Forgery (SSRF). An attacker can leverage this to:
Access Internal Services: Reach internal HTTP services, databases, or other network-accessible resources that are not exposed to the public internet.
Read Sensitive Data: Interact with internal APIs or cloud metadata services (e.g., AWS EC2 metadata) to retrieve sensitive configuration data, credentials, or other secrets.
Pivot to Internal Networks: Use the vulnerable server as a proxy to scan and attack other systems within the internal network.
Bypass Security Controls: Completely circumvent the SSRF protection that the `dssrf` library was designed to provide, undermining the security of the application.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
