CVE-2023-42282

Published: Feb 8, 2024

Modified: May 15, 2025

PUBLISHED

Description

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html

https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894

https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/

https://security.netapp.com/advisory/ntap-20240315-0008/

https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2023-42282

Description

Affected Products

References