{"id":"GHSA-78xj-cgh5-2h22","summary":"NPM IP package incorrectly identifies some private IP addresses as public","details":"The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.","aliases":["CVE-2023-42282"],"modified":"2026-07-17T21:04:55.016206039Z","published":"2024-02-08T18:30:39Z","database_specific":{"nvd_published_at":"2024-02-08T17:15:10Z","cwe_ids":["CWE-918"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2024-02-09T15:03:18Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42282"},{"type":"WEB","url":"https://github.com/JoshGlazebrook/socks/issues/93#issue-2128357447"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/3504#issuecomment-1937179999"},{"type":"WEB","url":"https://github.com/indutny/node-ip/pull/138"},{"type":"WEB","url":"https://github.com/indutny/node-ip/commit/32f468f1245574785ec080705737a579be1223aa"},{"type":"WEB","url":"https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894"},{"type":"WEB","url":"https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html"},{"type":"PACKAGE","url":"https://github.com/indutny/node-ip"}],"affected":[{"package":{"name":"ip","ecosystem":"npm","purl":"pkg:npm/ip"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-78xj-cgh5-2h22/GHSA-78xj-cgh5-2h22.json"}},{"package":{"name":"ip","ecosystem":"npm","purl":"pkg:npm/ip"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-78xj-cgh5-2h22/GHSA-78xj-cgh5-2h22.json"}}],"schema_version":"1.9.0"}