GHSA-6q4w-3wp4-q5wf
Denial of Service in get-ip-range
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | get-ip-range | < 4.0.0 | 4.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion. Update get-ip-range dependency to 4.0.0 or above.
References
External links from the advisory. They lead to third-party sites.