npm/private-ip CVE-2025-8020: high 8.2, EPSS 0.38%
private-ip vulnerable to Server-Side Request Forgery
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.0.2 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-9h3q-32c7-r533
- https://nvd.nist.gov/vuln/detail/CVE-2025-8020
- https://gist.github.com/lirantal/ed18a4493ca9fe4429957c79454a9df1
- https://github.com/frenchbread/private-ip
- https://security.snyk.io/vuln/SNYK-JS-PRIVATEIP-9510757
CVE-2025-8020 · published · modified · JSON