SSRF Vulnerability in Node-IP Package: Improper Categorization of IP Address 0
Summary
CVE-2025-59437: The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic. Affects node-ip versions 1.1.5+~1.1.0-1 – 2.0.1+~1.1.3-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-ip package, also known as 'ip', is a widely used library in Node.js applications that provides utilities for working with IP addresses. It allows developers to easily manipulate and validate IP addresses, offering functions to check if an address is public or private, among other features. However, a critical vulnerability has been identified in versions up to 2.0.1, which may allow Server-Side Request Forgery (SSRF) due to improper handling of the IP address value 0, categorized incorrectly as globally routable.
Vulnerability Detail
The vulnerability, identified as CVE-2025-59437, arises from an incomplete fix for a previous issue (CVE-2024-29415). The node-ip package fails to correctly classify the IP address 0 (interpreted as 0.0.0.0) as non-routable. This misclassification can lead to SSRF attacks, where an attacker could potentially exploit the application to make unauthorized requests to internal services. In some scenarios, connection attempts to 0.0.0.0 may be treated as requests to 127.0.0.1, which could allow attackers to access sensitive internal resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation in your application to block requests to the IP address 0. This can be done by adding a check in your code before making any network requests. For example:
if (ipAddress === '0.0.0.0') {
throw new Error('Invalid IP address: 0.0.0.0');
}
Conclusion
The CVE-2025-59437 vulnerability in the node-ip package poses a significant risk due to improper handling of the IP address 0, which can lead to SSRF attacks. It is crucial for developers to update their packages to the latest version and implement necessary workarounds to safeguard their applications.
See every vulnerability recorded for node-ip →
FAQ
CVE-2025-59437 is a vulnerability in the node-ip package that allows improper handling of the IP address 0, potentially leading to SSRF attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects all versions of the node-ip package up to and including 2.0.1.
If you cannot update the package right away, implement input validation to block requests to the IP address 0 as a temporary workaround.
More information can be found in the CVE database and through the node-ip package repository on GitHub.
Related vulnerabilities
Recent vulnerabilities recorded for node-ip.
