{"id":"CVE-2023-42282","aliases":["AZL-34379","AZL-34380","AZL-34439","AZL-35042","CLSA-2026-1774657398","CLSA-2026-1774657399","DEBIAN-CVE-2023-42282","EUVD-2024-0552","GHSA-78xj-cgh5-2h22","ROOT-APP-NPM-CVE-2023-42282","UBUNTU-CVE-2023-42282","USN-6643-1"],"status":"published","title":"NPM IP package incorrectly identifies some private IP addresses as public","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01613,"percentile":0.76144,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2024-02-08T00:00:00Z","modified":"2026-11-06T11:15:09Z","fixes":[{"ecosystem":"npm","package":"ip","fixed_in":["2.0.1","1.1.9"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs","fixed_in":["16.20.2-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs18","fixed_in":["18.18.2-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"ip","fixed_in":["1.1.5-tuxcare.1","2.0.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-ip","fixed_in":["2.0.1+~1.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-ip","fixed_in":["2.0.1+~1.1.3-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"ip","fixed_in":["2.0.0-aikido.3","1.1.5-aikido.2","1.1.8-aikido.1","1.1.9-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/ip","fixed_in":["2.0.0-root.io.2","2.0.0-root.io.3","1.1.5-root.io.2","1.1.8-root.io.1","1.1.9-root.io.1","1.1.9-root.io.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-ip","fixed_in":["1.1.5-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-ip","fixed_in":["1.1.5-5ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-ip","fixed_in":["1.1.5+~1.1.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"node-ip","fixed_in":["2.0.0+~1.1.0-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]},{"source":"ghsa","ecosystem":"npm","package":"ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.5-tuxcare.0"},{"fixed":"1.1.5-tuxcare.1"}]}],"versions":["1.1.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"Debian:12","package":"node-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0+~1.1.0-1","2.0.1+~1.1.3-1","2.0.1+~1.1.3-2","2.0.1+~1.1.3-3"]},{"source":"osv","ecosystem":"Debian:13","package":"node-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1+~1.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1+~1.1.3-1"}]}]},{"source":"osv","ecosystem":"npm","package":"ip","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"npm","package":"ip","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.9"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-aikido.3"},{"fixed":"1.1.5-aikido.2"},{"fixed":"1.1.8-aikido.1"},{"fixed":"1.1.9-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-root.io.2"},{"fixed":"2.0.0-root.io.3"},{"fixed":"1.1.5-root.io.2"},{"fixed":"1.1.8-root.io.1"},{"fixed":"1.1.9-root.io.1"},{"fixed":"1.1.9-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-1ubuntu0.1~esm1"}]}],"versions":["1.1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-5ubuntu0.1~esm1"}]}],"versions":["1.1.5-3","1.1.5-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5+~1.1.0-1ubuntu0.1~esm1"}]}],"versions":["1.1.5-5","1.1.5+~1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+~1.1.0-1ubuntu1"}]}],"versions":["2.0.0+~1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-1ubuntu0.1~esm1"}]}],"versions":["1.1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-5ubuntu0.1~esm1"}]}],"versions":["1.1.5-3","1.1.5-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5+~1.1.0-1ubuntu0.1~esm1"}]}],"versions":["1.1.5-5","1.1.5+~1.1.0-1"]}],"products":[{"vendor":"fedorindutny","product":"ip"}],"references":[{"url":"https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894","tags":["x_transferred","Patch","fix","web"]},{"url":"https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/","tags":["x_transferred","Exploit","Technical Description","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240315-0008/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/","tags":["x_transferred","Press/Media Coverage","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42282","tags":["web","advisory"]},{"url":"https://github.com/JoshGlazebrook/socks/issues/93#issue-2128357447","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/3504#issuecomment-1937179999","tags":["web"]},{"url":"https://github.com/indutny/node-ip/pull/138","tags":["web"]},{"url":"https://github.com/indutny/node-ip/commit/32f468f1245574785ec080705737a579be1223aa","tags":["web"]},{"url":"https://github.com/advisories/GHSA-78xj-cgh5-2h22"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42282.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-42282","tags":["advisory"]},{"url":"https://github.com/indutny/node-ip","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-42282","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6643-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42282","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-42282","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","status":"published","published":"2024-02-08T00:00:00Z","modified":"2025-05-15T19:42:13.205Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:35:17.812395Z"}],"euvd":[{"id":"EUVD-2024-0552","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","status":"published","published":"2024-02-08T00:00:00Z","modified":"2025-05-15T19:42:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:46.094311Z"}],"ghsa":[{"id":"GHSA-78xj-cgh5-2h22","title":"NPM IP package incorrectly identifies some private IP addresses as public","description":"The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.","status":"published","published":"2024-02-08T18:30:39Z","modified":"2026-03-18T05:07:55Z","cwes":["CWE-918"],"updated_at":"2026-11-02T14:39:37.554665Z"}],"nvd":[{"id":"CVE-2023-42282","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","status":"published","published":"2024-02-08T17:15:10.84Z","modified":"2026-06-17T06:23:41.113Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:09:04.527564Z"}],"osv":[{"id":"AZL-34379","title":"CVE-2023-42282 affecting package nodejs for versions less than 16.20.2-3","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","status":"published","published":"2024-02-08T17:15:10Z","modified":"2026-04-21T04:27:07.088656Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34380","title":"CVE-2023-42282 affecting package nodejs18 for versions less than 18.18.2-4","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","status":"published","published":"2024-02-08T17:15:10Z","modified":"2026-04-21T04:27:07.266147Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34439","title":"CVE-2023-42282 affecting package reaper for versions less than 3.1.1-10","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","status":"published","published":"2024-02-08T17:15:10Z","modified":"2026-04-21T04:27:07.510453Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-35042","title":"CVE-2023-42282 affecting package nodejs for versions less than 20.14.0-1","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","status":"published","published":"2024-02-08T17:15:10Z","modified":"2026-04-21T04:56:48.554921Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"CVE-2023-42282","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","status":"published","published":"2024-02-08T00:00:00Z","modified":"2026-10-28T02:30:24.751076429Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DEBIAN-CVE-2023-42282","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","status":"published","published":"2024-02-08T17:15:10.84Z","modified":"2026-10-26T18:00:12.442592161Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"ROOT-APP-NPM-CVE-2023-42282","title":"CVE-2023-42282 in ip - Patched by Root","description":"Root has patched CVE-2023-42282 in the ip package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T10:52:13Z","modified":"2026-11-06T11:15:09.478905464Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T11:42:45.055937Z"},{"id":"UBUNTU-CVE-2023-42282","description":"The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.","status":"published","published":"2024-02-09T00:00:00Z","modified":"2026-02-04T02:59:26.181009Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CLSA-2026-1774657398","title":"TuxCare security update for ip (1 CVE)","description":"TuxCare rebuilt ip to address 1 CVE. Fixed in 1.1.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T19:13:10.798518488Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774657399","title":"TuxCare security update for ip (1 CVE)","description":"TuxCare rebuilt ip to address 1 CVE. Fixed in 2.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.443704337Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"GHSA-78xj-cgh5-2h22","title":"NPM IP package incorrectly identifies some private IP addresses as public","description":"The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.","status":"published","published":"2024-02-08T18:30:39Z","modified":"2026-09-10T03:50:09.79488294Z","cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"USN-6643-1","title":"node-ip vulnerability","description":"Emre Durmaz discovered that NPM IP package incorrectly distinguished\nbetween private and public IP addresses. A remote attacker could\npossibly use this issue to perform\nServer-Side Request Forgery (SSRF) attacks.\n","status":"published","published":"2024-02-19T17:14:36Z","modified":"2026-04-27T17:05:49.457126Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}