All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code.
References:GSA_kwCzR0hTQS05aDNxLTMyYzctcjUzM84ABKcS
private-ip vulnerable to Server-Side Request Forgery
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| npm:private-ip | <= 3.0.2 | No known fixed version | |
Affected Version RangesAll affected versions0.1.0, 1.0.0, 1.0.1, 1.0.2, 1.0.5, 2.0.0, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 3.0.0, 3.0.1, 3.0.2 |
|||