CVE-2025-59436
The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally r...
Original description
The description as published by the source.
The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-59436 node-ip
- Ubuntu UBUNTU-CVE-2025-59436 node-ip
References
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web cosmosofcyberspace.github.io