CVE-2026-54729: dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

July 31, 2026

is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery.

References

github.com/HackingRepo/dssrf-js/commit/668c21792cd1252baf779a176aa652e2b4c0067d
github.com/HackingRepo/dssrf-js/pull/102
github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j
github.com/advisories/GHSA-5846-7qm3-r52j
nvd.nist.gov/vuln/detail/CVE-2026-54729

Code Behaviors & Features

Detect and mitigate CVE-2026-54729 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →