Skip to content
OpenAdvisories

Package · npm

ip

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.1
    CVE-2024-29415 Public exploit

    ip SSRF improper categorization in isPublic

    The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of …

    node-ip node-ip ip Debian Ubuntu npm
  • Critical 9.8
    CVE-2023-42282

    NPM IP package incorrectly identifies some private IP addresses as public

    The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

    node-ip node-ip ip Debian Ubuntu npm