CVE-2023-42282

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2024-02-08

Last modified

2025-05-15

Weaknesses

CWE-918

Affected products

• Ip (Fedorindutny)

References

• https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
• https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894
• https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/
• https://security.netapp.com/advisory/ntap-20240315-0008/
• https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/