npm ip vulnerabilities

Latest npm ip CVEs

Newest publication first

1. CVE-2024-29415 ip SSRF improper categorization in isPublic

   Published 2024-05-27

   High·CVSS 8.1 EPSS 8.3%

   The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for...

2. CVE-2023-42282 NPM IP package incorrectly identifies some private IP addresses as public

   Published 2024-02-08

   Critical·CVSS 9.8 EPSS 1.6%

   The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.