CVE-2026-54729: dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

July 31, 2026

is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery.

References

github.com/HackingRepo/dssrf-js/commit/668c21792cd1252baf779a176aa652e2b4c0067d
github.com/HackingRepo/dssrf-js/pull/102
github.com/HackingRepo/dssrf-js/security/advisories/GHSA-5846-7qm3-r52j
github.com/advisories/GHSA-5846-7qm3-r52j
nvd.nist.gov/vuln/detail/CVE-2026-54729

Code Behaviors & Features

Detect and mitigate CVE-2026-54729 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →