CVE-2025-8020: private-ip Package Vulnerable to Server-Side Request Forgery
Summary
CVE-2025-8020: private-ip vulnerable to Server-Side Request Forgery. Affects private-ip versions < 3.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'private-ip' package is a Node.js library designed to determine whether a given IP address is a private IP address. It is commonly used in applications that require network address validation. However, this package has a vulnerability that allows attackers to exploit it for Server-Side Request Forgery (SSRF) attacks, potentially leading to unauthorized access to internal services.
Vulnerability Detail
All versions of the 'private-ip' package are susceptible to Server-Side Request Forgery (SSRF). An attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4), which is not included in the package's defined private IP ranges. This oversight can allow attackers to access internal resources that should be protected, leading to potential data breaches or unauthorized actions within the network.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to filter out any IP addresses that fall within the multicast range (224.0.0.0 to 239.255.255.255) before passing them to the 'private-ip' package. This can help mitigate the risk of SSRF attacks until the package is updated.
Conclusion
The 'private-ip' package is vulnerable to SSRF attacks, which can lead to serious security risks. It is crucial to update to the patched version to mitigate these risks. Implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for private-ip →
FAQ
SSRF is a type of attack where an attacker can send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access or data exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, implement input validation to block multicast IP addresses as a temporary measure.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
More information can be found in the advisory database at GitHub: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9h3q-32c7-r533/GHSA-9h3q-32c7-r533.json.
Related vulnerabilities
Recent vulnerabilities recorded for private-ip.
