Skip to main content
cve.nowby Sazabi
← npm
npmPackage

dssrf

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release
1.0.6 (Jun 16, 2026): no advisory affects it
Newest unaffected release
1.0.6 (Jun 16, 2026), the latest release
Advisories
3 · 3 high
Weekly downloads
7,785
Dependents
1
Releases
7 since 1.0.0 (Dec 12, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

    Affected: fixed in 1.0.5.

    Fixed in 1.0.5 (released Jun 9, 2026, 52 days before disclosure).

    The latest release, 1.0.6, is not affected.

    1.9% of dssrf downloads last week were affected versions (157).

  • dssrf: there a critical security bug with remove_at_symbol_in_string

    Affected: fixed in 1.0.4.

    Fixed in 1.0.4 (released Jun 9, 2026, 51 days before disclosure).

    The latest release, 1.0.6, is not affected.

    1.6% of dssrf downloads last week were affected versions (134).

  • dssrf: every IPv6 category bypasses is_url_safe

    Affected: fixed in 1.0.3.

    Fixed in 1.0.3 (released Apr 27, 2026, 15 days before disclosure).

    The latest release, 1.0.6, is not affected.

    1.4% of dssrf downloads last week were affected versions (119).