The vulnerability exists in the dssrf-js Node.js library. Before version 1.3.0, the is_url_safe routine considers every IPv6 address to be safe, allowing an attacker to inject URLs that the library will deem legitimate. As a result, code that uses dssrf-js can inadvertently resolve internal network addresses that should be blocked, creating a classic SSRF bypass. The flaw can lead to retrieval of sensitive internal data or execution of code on internal services that the application can reach. The weakness is classified as CWE‑791.

The affected product is HackingRepo's dssrf-js library, versions prior to 1.3.0. The fix is available in 1.3.0 and later.

The CVSS score of 8.7 signals high severity. The EPSS score is not listed, so the current exploitation probability is unknown, and the vulnerability is not yet reported in CISA KEV, suggesting no confirmed public exploits. Attackers who can supply arbitrary URLs to an application that uses dssrf-js can exploit the unsafe IPv6 handling to reach internal hosts. The vulnerability therefore poses a significant risk in environments where the library is exposed to untrusted input. The likely attack vector is remote, contingent on the application’s exposure, and requires an attacker who can influence the URL being passed to the library.