Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.9

Node.js ip-utils: Malicious Server Access Through Misidentified IP Addresses

CVE-2024-28607 · published 1 year ago
Summary

This issue affects Node.js's ip-utils package up to version 2.4.0. A vulnerability in the package could allow attackers to access internal servers by exploiting a misidentification of IP addresses. To protect your applications, update the ip-utils package to a version greater than 2.4.0.

Original advisory text
The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate return value.
The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate return value.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.9 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-180Incorrect Behavior Order: Validate Before Canonicalize
Timeline
Published11 Mar 2025
Updated26 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-28607 · NVD
Track software like this
Free during beta