CVE-2026-54722

The record

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service. This issue is fixed in version 1.0.4.

Affected packages

Related vulnerabilities

• CVE-2026-77180 When NGINX Ingress Controller is configured with Ingress annotations, an injection… CWE-76
• CVE-2026-66362 Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an… CWE-76
• CVE-2024-34359 llama-cpp-python is the Python bindings for llama.cpp. CWE-76