DSSRF — OWASP-Listed SSRF Defense Library
- Home
- Projects
Project Overview
DSSRF is an open-source JavaScript library I wrote and maintain. It validates and sanitizes a URL before your application makes an outbound request, so server-side request forgery is stopped at the gate. It exists because I kept rewriting the same validation code on engagement after engagement, and kept watching teams get it subtly wrong in the same places — usually IPv6 forms or redirect handling. DSSRF packages that knowledge into one dependency-light module that sits in front of whatever HTTP client you already use. It is now listed by the OWASP Foundation under Free for Open Source Application Security Tools as a defense tool, with 300,000+ downloads on npm and over a million reached through GitHub.
Challenges
- Validate the destination rather than the URL string, because a hostname can resolve to an internal address.
- Cover every IPv6 form — loopback, unique-local, link-local, IPv4-mapped and NAT64 — without gaps.
- Close redirect chains and userinfo (user@host) prefixes at every hop, not just on the first URL.
- Prevent the DNS answer from changing between the check and the connection (DNS rebinding).
- Keep the library small and auditable so a defense tool does not become a new attack surface itself.
Approach
- Validate at resolve time rather than parse time, checking every returned address against the deny-list.
- Ship a deny-list that covers the private and special-use ranges of both IPv4 and IPv6 by default.
- Re-run the same validation on every hop when redirects are followed.
- Continuously attack my own library and publish and fix what I find, rather than assuming it is correct.
- Release under MIT so any JavaScript project can adopt it in a few lines.
Recognised by OWASP
“dssrf — Defend Against SSRF attacks by providing huge of utils for validation; you integrate it with your web client before making request, you validate the url for eliminating SSRF attacks.”
— OWASP Foundation, Free for Open Source Application Security Tools (Defense Tools)
Attacking My Own Library
A defense tool only earns trust if somebody is attacking it. I keep researching my own library and publishing what I find:
- CVE-2026-44232 — IPv6 SSRF allow-list bypass (CVSS 8.7). Fixed in 1.0.3.
- CVE-2026-54722 — SSRF bypass caused by the incomplete fix in 1.0.3 (HIGH).
- CVE-2026-54729 — Localhost SSRF when 1.1.1.1 is the DNS resolver. Fixed in 1.0.5.
Publishing the flaws instead of hiding them is what has actually made the library stronger. Run the latest version, and read the published advisories.