CVE-2026-54729: SSRF Protection Bypass in dssrf-js via NXDOMAIN Resolution Discrepancy

dssrf-js is a Node.js-based utility library designed to prevent Server-Side Request Forgery (SSRF) by validating URLs before they are processed by outbound HTTP clients. In modern cloud and microservices architectures, web applications frequently make outward network requests to fetch remote resources, call third-party APIs, or process user-supplied webhooks. If these outbound requests are not strictly verified, attackers can manipulate the request parameters to force the server to connect to internal services, local databases, or administrative interfaces.\n\nValidation libraries like dssrf-js act as gatekeepers, analyzing target hostnames and IPs to ensure they resolve exclusively to public, non-private destinations. This vulnerability exposes a critical security bypass where the validation mechanism fails to recognize local domain names, creating a vector for unauthorized internal network access. Applications relying on vulnerable versions of this library are subject to full SSRF bypass if the host environment queries public DNS servers.

The root cause of this vulnerability lies in a fundamental discrepancy between two distinct DNS resolution mechanisms provided by Node.js. The vulnerable versions of dssrf-js used network-level APIs like dns.resolve4() to resolve target domain names. Unlike standard lookup operations, these APIs bypass the operating system's local resolver configurations, such as the /etc/hosts file or local DNS caches, and query the system's configured upstream DNS servers directly. If the application environment is configured to use a public external resolver like Cloudflare's 1.1.1.1, querying a domain such as localhost returns an NXDOMAIN error because the domain does not exist in the public DNS namespace.\n\nThe library wrapped these resolution queries in .catch(() => []) blocks, which swallowed the NXDOMAIN error and returned an empty array of IP addresses. Since the array of resolved IPs was empty, the safety checks in dssrf-js concluded that the host did not resolve to any internal or loopback IP addresses, classifying the domain as safe.\n\nWhen the host application subsequently executed the actual HTTP request using an HTTP client like axios or Node's internal http module, the client performed an OS-level name lookup (equivalent to dns.lookup()). This lookup respected local configurations and successfully resolved localhost to 127.0.0.1 or ::1, completing the connection to the internal service and bypassing the safety validation.

In vulnerable versions of dssrf-js, DNS resolution was handled by sequential, direct network-level resolution calls that did not evaluate system-level files. The following code snippet shows the flawed implementation in helper functions:\n\ntypescript\n// Vulnerable implementation in dssrf-js < 1.0.5\nasync function resolve_all_records(host: string) {\n const A = await dns.resolve4(host).catch(() => []);\n const AAAA = await dns.resolve6(host).catch(() => []);\n const CNAME = await dns.resolveCname(host).catch(() => []);\n\n return {\n A,\n AAAA,\n CNAME\n };\n}\n\n\nThe patched version resolves the issue by executing DNS resolution concurrently and adding a fallback mechanism to trigger dns.lookup() when direct network resolution fails to return any IP records. The patched implementation is shown below:\n\ntypescript\n// Patched implementation in dssrf-js 1.0.5\nasync function resolve_all_records(host: string) {\n const [A, AAAA, CNAME] = await Promise.all([\n dns.resolve4(host).catch(() => [] as string[]),\n dns.resolve6(host).catch(() => [] as string[]),\n dns.resolveCname(host).catch(() => [] as string[])\n ]);\n\n if (A.length === 0 && AAAA.length === 0) {\n try {\n // Fallback to local OS-level resolution to capture localhost or /etc/hosts entries\n const lookups = await dns.lookup(host, { all: true });\n for (const entry of lookups) {\n if (entry.family === 4) A.push(entry.address);\n if (entry.family === 6) AAAA.push(entry.address);\n }\n } catch {}\n }\n\n return { A, AAAA, CNAME };\n}\n\n\nWhile this fallback correctly captures OS-configured domains, the error handling within the fallback is wrapped in an empty catch block. If the local system's dns.lookup() fails or times out due to resource constraints, the library will still return empty arrays, which could lead to validation bypasses in unstable host environments.

To exploit this vulnerability, an attacker must identify an application endpoint that validates URLs using dssrf-js prior to version 1.0.5 and then performs a network request to the validated URL. The attack is highly reliable in environments where the host container or server utilizes an external DNS server such as 1.1.1.1 or 8.8.8.8 for network resolution. The attacker passes a URL targeting internal administration endpoints or databases binding to loopback addresses.\n\nmermaid\ngraph LR\n A["Attacker Payload: http://localhost:8080/admin"] --> B["Node.js Application Host"]\n B --> C["dssrf-js is_url_safe('localhost')"]\n C --> D["dns.resolve4('localhost') queries 1.1.1.1"]\n D --> E["1.1.1.1 returns NXDOMAIN"]\n E --> F["dssrf-js swallows error, returns safe (true)"]\n F --> G["HTTP Client connects to http://localhost:8080/admin"]\n G --> H["OS-level dns.lookup() resolves to 127.0.0.1"]\n H --> I["Request executed on Local Admin Port"]\n\n\nBecause no credentials or specialized payloads are required, the exploit can be initiated with a single unauthenticated HTTP request containing the target URL. The host application validates the domain, receives a positive safety result, and initiates the internal connection, granting the attacker unauthenticated access to internal loopback resources.

Despite the fallback implementation in version 1.0.5, applications relying on validation-based libraries like dssrf-js remain vulnerable to structural attack techniques. The most prominent risk is DNS Rebinding, which exploits the Time-of-Check to Time-of-Use (TOCTOU) gap. During validation, the library resolves the hostname and checks the IP. Once validated, the host application's HTTP client must resolve the hostname a second time to establish the TCP connection.\n\nAn attacker can set up a custom DNS server with a low Time-To-Live (TTL) of 0 seconds. During the validation phase, the server returns a benign public IP address. Immediately after, when the HTTP client performs its DNS resolution to connect, the server returns an internal IP address (such as 127.0.0.1 or the AWS metadata endpoint 169.254.169.254). This completely bypasses the static validation logic.\n\nFurthermore, custom URL parsing inside validation libraries introduces potential parsing discrepancies. If the parser used by the validation library handles special characters, userinfo credentials, or port formatting differently than the downstream HTTP client (such as Axios, Fetch, or Request), attackers can construct obfuscated URLs that bypass validation filters but are interpreted as internal targets by the client. Relying on application-level validation without locking the resolved IP address is an inherently weak design pattern.

The primary remediation strategy is upgrading the dssrf-js dependency to version 1.0.5 or higher. This incorporates the OS-level lookup fallback, resolving the hostname mismatch. Organizations can execute npm install dssrf-js@1.0.5 to apply the patch.\n\nTo achieve defense-in-depth, security teams must implement network-level controls. Relying entirely on application-layer software libraries to stop SSRF is a risky strategy. By configuring outbound firewalls, security groups, or egress rules, organizations can prevent application servers from establishing outbound TCP connections to localhost, private IP subnets (RFC 1918), and local cloud metadata endpoints (e.g., 169.254.169.254).\n\nUtilizing a dedicated forward proxy designed to intercept and filter outbound requests represents the most robust long-term architectural pattern. Outbound proxies enforce safety boundaries independently of application code parsing discrepancies or lookup fallbacks.