CVE-2020-28360: Server-Side Request Forgery in private-ip
Summary
CVE-2020-28360: Server-Side Request Forgery in private-ip. Affects private-ip versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The private-ip npm package is a utility library for working with IP addresses in Node.js applications. It provides functions to validate and manipulate IP addresses. The package is widely used in various Node.js projects and is a critical component for handling network-related operations. However, versions 1.0.5 and below of the private-ip package suffer from a vulnerability that allows for Server-Side Request Forgery (SSRF) attacks. SSRF occurs when an attacker can manipulate the server to make requests to arbitrary destinations, potentially leading to unauthorized access or remote code execution.
Vulnerability Detail
The vulnerability in private-ip arises from insufficient filtering of reserved IP ranges. The package fails to properly validate and block requests to reserved IP ranges, as defined by ARIN. This oversight allows an attacker to perform a wide range of requests to these reserved IP ranges, opening up numerous attack vectors. The exact impact of these attacks can vary, but they can potentially lead to unauthorized access to server-side resources or even the execution of arbitrary code. This vulnerability is assigned a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 3.0.2 as of 23 Oct 2026
npm install private-ip@3.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0
This is the first release that contains the fix.
npm install private-ip@2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the private-ip package is not immediately feasible, a temporary workaround can be implemented by manually validating and blocking requests to reserved IP ranges within the application code. This can be done by using a regular expression or a custom validation function to check the target IP address against a list of reserved ranges. Here is an example of how this can be done in Node.js:
const privateIp = require('private-ip');
function isReservedIp(ip) {
const reservedRanges = privateIp.reservedRanges();
return reservedRanges.some(range => range.contains(ip));
}
const targetIp = '192.168.0.1';
if (isReservedIp(targetIp)) {
// Block or handle the request
} else {
// Process the request
}
Conclusion
The private-ip npm package is vulnerable to a critical SSRF vulnerability that allows for unauthorized access to server-side resources or the execution of arbitrary code. It is crucial to update the package to version 2.0.0 or above to mitigate this vulnerability. If immediate update is not possible, implementing a temporary workaround by manually validating and blocking requests to reserved IP ranges can provide some protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for private-ip →
FAQ
The private-ip npm package is a utility library for working with IP addresses in Node.js applications. It provides functions to validate and manipulate IP addresses.
Server-Side Request Forgery (SSRF) is a type of vulnerability where an attacker can manipulate the server to make requests to arbitrary destinations, potentially leading to unauthorized access or remote code execution.
The private-ip vulnerability allows for SSRF attacks, which can result in unauthorized access to server-side resources or the execution of arbitrary code.
To fix the private-ip vulnerability, it is recommended to update the package to version 2.0.0 or above.
A temporary workaround can be implemented by manually validating and blocking requests to reserved IP ranges within the application code.
References
Related vulnerabilities
Recent vulnerabilities recorded for private-ip.
