CVE-2023-42282

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Affected products

Bitbucket, Confluence, Debian, Linuxmint, Ubuntu, Ip

Fedorindutny Ip

< 1.1.9, 2.0.0

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

1.6% (74th percentile)

Weakness

CWE-918

NVD status

Modified

Published

2024-02-08

No exploit for CVE-2023-42282 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.