The ip package prior to 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
fedorindutny ip |
||
fedorindutny ip 2.0.0 |