The dssrf-js Node.js library contains a flaw that can treat localhost URLs as safe when the DNS resolver 1.1.1.1 returns NXDOMAIN. In versions prior to 1.0.5, the function is_url_safe fails to fall back to dns.lookup after dns.resolve4 yields no address, allowing an attacker to pass a URL that points to an internal resource and be able to cause the server to resolve and request that resource. The result is SSRF, giving the attacker potential control over data exfiltration, port scanning or the triggering of internal services that may be privileged. The weakness is classified as CWE‑918.

All users of the HackingRepo dssrf‑js library with a version earlier than 1.0.5 are impacted. This includes any application that imports the library and uses is_url_safe for sanitizing user‑supplied URLs, especially when configured to use Cloudflare’s 1.1.1.1 DNS resolver. No higher versions are known to be affected.

The CVSS score of 8.7 marks the vulnerability as high severity. The EPSS score of less than 1% indicates that, as of the last assessment, the probability of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that application code can supply a URL to is_url_safe and that Cloudflare’s resolver is present, so the attacker would first need to influence the target application’s input or be able to modify its configuration. Nevertheless, the impact could be substantial if successful, potentially allowing compromise of internal services.