~ / search / GHSA-78xj-cgh5-2h22

GHSA-78xj-cgh5-2h22

NPM IP package incorrectly identifies some private IP addresses as public

Source: GitHub Advisory Database (reviewed) Low CVE-2023-42282

Packages

EcosystemPackageAffectedFixed in
npm ip >= 2.0.0, < 2.0.1 2.0.1
npm ip < 1.1.9 1.1.9

Details

As written in the advisory (Markdown source, shown as plain text).

The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.

References

External links from the advisory. They lead to third-party sites.