{"vulnerability": "cve-2026-54729", "sightings": [{"uuid": "e077fd35-507d-49dd-abe3-0f0a8d0a51de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54729", "type": "seen", "source": "https://gist.github.com/alon710/3725c6658b9e4e7f9bed06e9ce214b76", "content": "# CVE-2026-54729: CVE-2026-54729: SSRF Protection Bypass in dssrf-js via NXDOMAIN Resolution Discrepancy\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54729\n\n## Summary\nCVE-2026-54729 is a critical Server-Side Request Forgery (SSRF) bypass vulnerability in the dssrf-js Node.js library prior to version 1.0.5. The flaw occurs because the library's DNS validation mechanism incorrectly treats domains like 'localhost' as safe when the configured upstream DNS resolver returns NXDOMAIN. Since the system's HTTP client later falls back to OS-level resolution (resolving 'localhost' to '127.0.0.1'), attackers can bypass validation and access internal loopback addresses.\n\n## TL;DR\nThe dssrf-js library fails to detect local/internal domains if upstream DNS servers return NXDOMAIN, allowing attackers to perform unauthenticated Server-Side Request Forgery (SSRF) to loopback endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.7 (High)\n- **Exploit Status**: PoC\n- **Impact**: Integrity (High)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- dssrf-js (Node.js library)\n- **dssrf-js**: < 1.0.5 (Fixed in: `1.0.5`)\n\n## Mitigation\n\n- Upgrade to dssrf-js version 1.0.5 or higher.\n- Implement network egress filtering to block connections to local and RFC 1918 addresses.\n- Deploy dedicated outbound HTTP forward proxies to intercept and validate outbound traffic.\n\n**Remediation Steps:**\n1. Audit the dependency graph for vulnerable versions of 'dssrf-js'.\n2. Update package.json to require version '^1.0.5' and run 'npm install'.\n3. Configure application servers with firewall rules blocking outbound TCP to 127.0.0.0/8 and 169.254.169.254.\n\n## References\n\n- [GitHub Security Advisory GHSA-5846-7qm3-r52j](https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j)\n- [Fix Commit 668c21792cd1252baf779a176aa652e2b4c0067d](https://github.com/HackingRepo/dssrf-js/commit/668c21792cd1252baf779a176aa652e2b4c0067d)\n- [CVE-2026-54729 Record](https://www.cve.org/CVERecord?id=CVE-2026-54729)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54729) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T17:31:37.590423Z"}, {"uuid": "dc33a1e6-73a6-4c5f-87ba-817da12efc4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54729", "type": "published-proof-of-concept", "source": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j", "content": "", "creation_timestamp": "2026-07-31T18:35:06.401884Z"}]}