Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

Published: 11/03/2025 Updated: 11/03/2025

Server-Side Request Forgery in Node.js ip-utils Package Through 2.4.0

The ip-utils package for Node.js through version 2.4.0 contains a potential server-side request forgery (SSRF) vulnerability. The issue stems from incorrect IP address categorization, where certain IP addresses like 0x7f.1 are incorrectly identified as globally routable due to a falsy return value from the isPrivate method. This misclassification could potentially allow an attacker to bypass IP address restrictions and make unauthorized requests.

Vulnerable Product	Search on Vulmon	Subscribe to Product
librasean ip-utils

CWE-180 https://nvd.nist.gov https://www.first.org/epss https://gist.github.com/aydinnyunus/4d71e7d9a433f3afc658724b903f4d23 https://github.com/librasean/IP-Utils/blob/4f88799f94f21efe6ea9135129ab2bbeb0c58edc/src/IsPrivate.ts#L4

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2024-28607

Vulnerability Summary

References

Vulmon Search

About

Products

Connect