EUVD-2025-29357

Malicious code in bioql PyPI...

CVE-2025-59436: Server-Side Request Forgery (SSRF)

The ip aka node-ip package through 2.0.1 in NPM might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415...

PT-2025-37863

Name of the Vulnerable Software and Affected Versions ip aka node-ip versions through 2.0.1 Description The ip aka node-ip package may allow Server-Side Request Forgery SSRF due to the improper categorization of the IP address value 017700000001 as globally routable via the isPublic function. Thi...

CVE-2025-59436

The CVE-2025-59436 entry concerns the npm package ip (node-ip) up to version 2.0.1, where an SSRF vulnerability can be triggered because the IP value 017700000001 is misclassified as globally routable by isPublic. This follows an incomplete fix for CVE-2024-29415. The base score is 3.2 (LOW) with...