high8.1
CVE-2024-29415
ip SSRF improper categorization in isPublic
Impact
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ip | <= 2.0.1 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| Ip Package | through 2.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/indutny/node-ip/issues/150
- https://github.com/indutny/node-ip/pull/143
- https://github.com/indutny/node-ip/pull/144
- https://security.netapp.com/advisory/ntap-20250117-0010/
- https://github.com/advisories/GHSA-2p57-rm9w-gvfp
- https://nvd.nist.gov/vuln/detail/CVE-2024-29415
- https://security.netapp.com/advisory/ntap-20250117-0010