HIGH: dssrf — dssrf has an SSRF bypass with remove_at_symbol_in_string
Summary isurlsafe in v1.0.3 contains an SSRF bypass. removeatsymbolinstring is applied to the raw URL string before new URL() parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked.…
Source dssrfPublished 4d ago · Jul 30, 2026Posted on Bluesky
What we hold
- Package
- dssrf
- Ecosystem
- npm
- Severity
- HIGH
- ID
- CVE-2026-54722
Summary isurlsafe in v1.0.3 contains an SSRF bypass. removeatsymbolinstring is applied to the raw URL string before new URL() parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked.…
More like this
HIGH: undici — undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly…
HIGH: fast-uri — fast-uri vulnerable to host confusion via backslash authority introducer
Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything…
CRITICAL: @nocobase/plugin-notification-in-app-message — NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal() template string with no escape, type cast, or parameter…