npm/ip CVE-2023-42282: low, EPSS 1.61%
NPM IP package incorrectly identifies some private IP addresses as public
Action: Upgrade ip to 1.1.9 or later.
npm i ip@2.0.1npm i ip@1.1.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.0.1 | - |
| 0 | 1.1.9 | - |
Fixed versions
| 2.0.1 | 1.1.9 |
Sources
- osv: GHSA-78xj-cgh5-2h22
- https://nvd.nist.gov/vuln/detail/CVE-2023-42282
- https://github.com/JoshGlazebrook/socks/issues/93#issue-2128357447
- https://github.com/github/advisory-database/pull/3504#issuecomment-1937179999
- https://github.com/indutny/node-ip/pull/138
- https://github.com/indutny/node-ip/commit/32f468f1245574785ec080705737a579be1223aa
- https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894
- https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
- https://github.com/indutny/node-ip
CVE-2023-42282 · published · modified · JSON