CVE-2025-59437

The ip aka node-ip package through 2.0.1 in NPM might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415. NOTE: in current versions of several applications, connection...

DEBIAN-CVE-2025-59437

The ip aka node-ip package through 2.0.1 in NPM might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415. NOTE: in current versions of several applications, connection...

Server-side Request Forgery (SSRF)

Overview ip is a Node library. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ip.isPublic and ip.isPrivate functions. An attacker can interact with internal network resources by supplying specially crafted IP address such as octal localhost format...

CVE-2025-59437

The ip aka node-ip package through 2.0.1 in NPM might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415. NOTE: in current versions of several applications, connection...

golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A flaw was found in the Go language standard library net/netip. The method Is IsPrivate, IsPublic, etc doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to...

The vulnerability of the isPublic() function in the node-ip utility of the Node.js software platform allows a attacker to execute an SSRF attack.

The vulnerability of the isPublic function in the node-ip utility of the Node.js software platform is related to incorrect classification of IP addresses. Exploiting this vulnerability could allow a remote attacker to execute an SSRF attack...

nodejs-ip: arbitrary code execution via the isPublic() function

A vulnerability was found in the NPM IP Package. This flaw allows an attacker to perform arbitrary code execution and obtain sensitive information via the isPublic function by inducing a Server-Side Request Forgery SSRF attack and obtaining access to normally inaccessible resources...

ip SSRF improper categorization in isPublic

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1 are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282...

GHSA-2P57-RM9W-GVFP ip SSRF improper categorization in isPublic

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1 are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282...

node-ip 安全漏洞

node-ip is a node.js module by indutny individual developer. A security vulnerability exists in node-ip version 2.0.1 and earlier, which stems from incorrect categorization of certain IP addresses that can be globally routed via isPublic, potentially leading to server-side request forgery SSRF...

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

...

Server Side Request Forgery (SSRF)

ip is vulnerable to Server Side Request Forgery. The vulnerability is due to the isPublic function's failure to interpret and classify hexadecimal IP address representations. If an application utilizes the isPublic or isPrivate functions to determine if an address is public, an attacker can prefo...

CVE-2023-42282

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via isPublic...

NPM IP package incorrectly identifies some private IP addresses as public

The isPublic function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery SSRF if isPublic is used to...

GHSA-78XJ-CGH5-2H22 NPM IP package incorrectly identifies some private IP addresses as public

The isPublic function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery SSRF if isPublic is used to...

PT-2024-2322 · Ip +3 · Ip +3

Name of the Vulnerable Software and Affected Versions: ip package versions prior to 1.1.9 Description: The issue is related to the improper categorization of certain IP addresses as globally routable via the isPublic function. This can lead to security issues such as Server-Side Request Forgery...

CVE-2023-42282

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via isPublic...

CVE-2023-42282

CVE-2023-42282 affects the Node.js ip package (pre-1.1.9) and can enable SSRF because certain IPs (e.g., 0x7f.1) are misclassified as globally routable by isPublic. The impact is SSRF to internal or restricted resources; exploitation details are not provided beyond the SSRF risk. Remediation: upg...

npm IP Package Code Issue Vulnerability

npm IP Package is an IP address utility for Node.js from npm, Inc. A code issue vulnerability exists in npm IP Package v.1.1.8 and earlier versions, which stems from a vulnerability that allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic function...