HIGH8.2

GHSA-9h3q-32c7-r533

private-ip vulnerable to Server-Side Request Forgery

Details

All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/private-ip

Introduced in: 0

No fixed version published yet for private-ip (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-8020[ADVISORY]
https://gist.github.com/lirantal/ed18a4493ca9fe4429957c79454a9df1[WEB]
https://github.com/frenchbread/private-ip[PACKAGE]
https://security.snyk.io/vuln/SNYK-JS-PRIVATEIP-9510757[WEB]