What’s Vulnerable › Vulnerabilities

CVE-2024-29415: ip SSRF improper categorization in isPublic

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-27 · updated 2026-06-17
• Weakness: CWE-918

Description

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

Affected products

• fedorindutny ip: before 2.0.1 — fixed in 2.0.1
• Npm Ip: through 2.0.1

How to fix

Upgrade to a fixed version: fedorindutny ip 2.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/indutny/node-ip/issues/150
• https://github.com/indutny/node-ip/pull/143
• https://github.com/indutny/node-ip/pull/144
• https://github.com/indutny/node-ip/issues/150
• https://github.com/indutny/node-ip/pull/143
• https://github.com/indutny/node-ip/pull/144
• https://security.netapp.com/advisory/ntap-20250117-0010/

Get alerted when CVE-2024-29415 or the next vulnerability affects your stack