Every CVE Search/ Get API key

CVE-2023-42282

NPM IP package incorrectly identifies some private IP addresses as public

9.8 CriticalFix available

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.61%Up 1.6 points since Feb 9, 2024
90%50%10%1%

What each source reports

NVD Score used 9.8

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Record
CVE-2023-42282
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-918
Updated
2026-11-02
CVE List 9.8

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Record
CVE-2023-42282
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2024-0552 9.8

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Record
EUVD-2024-0552
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-78xj-cgh5-2h22 No score

NPM IP package incorrectly identifies some private IP addresses as public

The isPublic() function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery (SSRF) if isPublic() is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.

Record
GHSA-78xj-cgh5-2h22
Weakness
CWE-918
Updated
2026-11-02
OSVAZL-34379 9.8

CVE-2023-42282 affecting package nodejs for versions less than 16.20.2-3

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Record
AZL-34379
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-34380 9.8

CVE-2023-42282 affecting package nodejs18 for versions less than 18.18.2-4

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Record
AZL-34380
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVAZL-34439 9.8

CVE-2023-42282 affecting package reaper for versions less than 3.1.1-10

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Record
AZL-34439
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-35042 9.8

CVE-2023-42282 affecting package nodejs for versions less than 20.14.0-1

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Record
AZL-35042
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Record
CVE-2023-42282
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-42282 9.8

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Record
DEBIAN-CVE-2023-42282
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2023-42282 9.8

CVE-2023-42282 in ip - Patched by Root

Root has patched CVE-2023-42282 in the ip package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2023-42282
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-06
OSVUBUNTU-CVE-2023-42282 9.8

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Record
UBUNTU-CVE-2023-42282
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1774657398 No score

TuxCare security update for ip (1 CVE)

TuxCare rebuilt ip to address 1 CVE. Fixed in 1.1.5-tuxcare.1.

Record
CLSA-2026-1774657398
Updated
2026-11-02
OSVCLSA-2026-1774657399 No score

TuxCare security update for ip (1 CVE)

TuxCare rebuilt ip to address 1 CVE. Fixed in 2.0.0-tuxcare.1.

Record
CLSA-2026-1774657399
Updated
2026-11-02
OSVGHSA-78xj-cgh5-2h22 No score

NPM IP package incorrectly identifies some private IP addresses as public

The isPublic() function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery (SSRF) if isPublic() is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.

Record
GHSA-78xj-cgh5-2h22
Weakness
CWE-918
Updated
2026-11-02
OSVUSN-6643-1 No score

node-ip vulnerability

Emre Durmaz discovered that NPM IP package incorrectly distinguished between private and public IP addresses. A remote attacker could possibly use this issue to perform Server-Side Request Forgery (SSRF) attacks.

Record
USN-6643-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ip
npm
 2.0.0 to 2.0.0
2.0.1
ip
npm
 before 1.1.9
1.1.9
nodejs
Azure Linux:2
 before 16.20.2-3
16.20.2-3
nodejs18
Azure Linux:2
 before 18.18.2-4
18.18.2-4
reaper
Azure Linux:2
 before 3.1.1-10
3.1.1-10
nodejs
Azure Linux:3
 before 20.14.0-1
20.14.0-1
ip
TuxCare:npm
 1.1.5-tuxcare.0 up to 1.1.5-tuxcare.1, plus listed versions
1.1.5
1.1.5-tuxcare.1
ip
TuxCare:npm
 2.0.0-tuxcare.0 up to 2.0.0-tuxcare.1, plus listed versions
2.0.0
2.0.0-tuxcare.1
node-ip
Debian:12
 All versions, plus listed versions
2.0.0+~1.1.0-12.0.1+~1.1.3-12.0.1+~1.1.3-22.0.1+~1.1.3-3
 None known
node-ip
Debian:13
 before 2.0.1+~1.1.3-1
2.0.1+~1.1.3-1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
node-ip
Debian:14
 before 2.0.1+~1.1.3-1
2.0.1+~1.1.3-1
ip
npm
 2.0.0 up to 2.0.1
2.0.1
ip
Root:npm
 before 2.0.0-aikido.3
2.0.0-aikido.31.1.5-aikido.21.1.8-aikido.11.1.9-aikido.2
@rootio/ip
Root:npm
 before 2.0.0-root.io.2
2.0.0-root.io.22.0.0-root.io.31.1.5-root.io.21.1.8-root.io.11.1.9-root.io.11.1.9-root.io.2
node-ip
Ubuntu:Pro:18.04:LTS
 before 1.1.5-1ubuntu0.1~esm1, plus listed versions
1.1.5-1
1.1.5-1ubuntu0.1~esm1
node-ip
Ubuntu:Pro:20.04:LTS
 before 1.1.5-5ubuntu0.1~esm1, plus listed versions
1.1.5-31.1.5-5
1.1.5-5ubuntu0.1~esm1
node-ip
Ubuntu:Pro:22.04:LTS
 before 1.1.5+~1.1.0-1ubuntu0.1~esm1, plus listed versions
1.1.5-51.1.5+~1.1.0-1
1.1.5+~1.1.0-1ubuntu0.1~esm1
node-ip
Ubuntu:24.04:LTS
 before 2.0.0+~1.1.0-1ubuntu1, plus listed versions
2.0.0+~1.1.0-1
2.0.0+~1.1.0-1ubuntu1

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-42282 is a critical vulnerability (CVSS 9.8) in Fedorindutny Ip, published February 8, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.61%, the 76th percentile. Fixed in ip 2.0.1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open