{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.0.2"}],"component":"private-ip","cve_ids":["CVE-2025-8020"],"ecosystem":"npm","epss":0.00381,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-9h3q-32c7-r533","id":"tcs_01M5KFFXP7C2H1MWVN4WXN15N7","modified_at":"2025-09-25T21:49:54Z","published_at":"2025-07-23T06:33:50Z","references":["https://osv.dev/vulnerability/GHSA-9h3q-32c7-r533","https://nvd.nist.gov/vuln/detail/CVE-2025-8020","https://gist.github.com/lirantal/ed18a4493ca9fe4429957c79454a9df1","https://github.com/frenchbread/private-ip","https://security.snyk.io/vuln/SNYK-JS-PRIVATEIP-9510757"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-9h3q-32c7-r533","url":"https://osv.dev/vulnerability/GHSA-9h3q-32c7-r533"}],"summary":"private-ip vulnerable to Server-Side Request Forgery"}