An unauthenticated Server-Side Request Forgery vulnerability in the dssrf-js library poses a high risk of unauthorized network interaction and internal resource access.

This is a Server-Side Request Forgery (CWE-918) vulnerability that can be triggered by unauthenticated attackers. The flaw resides in the handling of user-supplied input, allowing the application to be coerced into making unintended network requests to internal or external destinations.

Successful exploitation allows an attacker to bypass perimeter security controls to probe internal network infrastructure or access sensitive services that are not exposed to the public internet. Given the CVSS score of 8.7, this vulnerability represents a significant threat to data confidentiality and network segmentation, potentially leading to unauthorized data exfiltration or internal service compromise.

Immediate Action: Update the dssrf-js package to version 1.0.5 or later immediately.

Proactive Monitoring: Review web server and application logs for anomalous outbound requests originating from the application server, particularly those targeting internal IP ranges.

Compensating Controls: Implement strict egress filtering on the application server to restrict outbound network connections to only known, required destinations.

Public Exploit Available: Unknown.

The severity of this SSRF vulnerability necessitates an immediate update to the patched version. Organizations utilizing dssrf-js should prioritize this remediation to prevent potential internal network reconnaissance and unauthorized access to sensitive backend services.