CVE-2023-42282

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.61% chance of exploitation in the next 30 days, 76th percentile

Published

2024-02-08

Updated

2025-05-15

Proof-of-concept exploits (4)

• https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
• ds-ac-poc/pt-esign__Damn-vulnerable-sca0★ · 2026-08-10
• pantor-org/prisma-cloud-kubernetes-exploitation-demo0★ · 2024-09-20
• appsec-poc-22/scagoat0★ · 2026-09-17

Security advisories

• https://security.netapp.com/advisory/ntap-20240315-0008
• advisories/GHSA-78xj-cgh5-2h22
• indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894

References

• CVE Record
• NVD entry

Related

• CVE-2024-4367
• CVE-2017-16114
• CVE-2021-44228