SSRF Vulnerability in node-ip Package: Improper IP Address Categorization
Summary
DEBIAN-CVE-2025-59436: The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. Affects node-ip versions 2.0.1+~1.1.3-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-ip package is a widely used library in the Node.js ecosystem that provides utilities for working with IP addresses. It allows developers to easily validate and manipulate IP addresses, ensuring that applications can handle networking tasks effectively. However, the package has been found to have a significant vulnerability that can lead to Server-Side Request Forgery (SSRF), which can compromise the security of applications relying on it.
Vulnerability Detail
The vulnerability identified as CVE-2025-59436 affects the node-ip package versions up to 2.0.1. It arises from an improper categorization of the IP address value 017700000001 as globally routable in the isPublic function. This flaw can potentially allow attackers to exploit the application by sending crafted requests to internal services, leading to unauthorized access and data exposure. The issue is particularly concerning as it stems from an incomplete fix for a previous vulnerability (CVE-2024-29415).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing additional validation checks for IP addresses in your application logic to prevent the use of the problematic IP address value 017700000001. This can help mitigate the risk of SSRF until the package is updated.
Conclusion
The node-ip package has a significant SSRF vulnerability due to improper IP address categorization. It is essential for developers using this package to update to the latest version to mitigate the risks associated with this vulnerability. Implementing additional validation checks can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for node-ip →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access and data exposure.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check if your application is affected by this vulnerability.
If an immediate update is not possible, implement additional validation checks for IP addresses in your application to mitigate the risk of SSRF until the package can be updated.
Yes, Vulert provides a solution that allows you to monitor open-source vulnerabilities in real-time without requiring access to the code or installation. You can use the Vulert playground to check your application for vulnerabilities.
Keeping packages updated is crucial for maintaining the security and stability of your application. Vulnerabilities can be exploited by attackers, so regular updates help protect against known issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-ip.
