GHSA-9h3q-32c7-r533HighCVSS 8.2

private-ip vulnerable to Server-Side Request Forgery

Published
July 23, 2025
Last Modified
September 25, 2025

🔗 CVE IDs covered (1)

CVE-2025-8020 →

📋 Description

All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code.

🎯 Affected products1

  • npm/private-ip:<= 3.0.2

🔗 References (4)