Skip to content
Fencer Vulns
critical 9.8

CVE-2023-42282 json

NPM IP package incorrectly identifies some private IP addresses as public

published 2024-02-08 2 y ago modified 2026-09-10 1 mo ago also GHSA-78xj-cgh5-2h22 , EUVD-2024-0552

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Patch / fix

  • npm ip 1.1.9, 2.0.1
  • fedorindutny ip 1.1.9
  • node-ip Debian 14, Debian 13 2.0.1+~1.1.3-1

debian advisories DEBIAN-CVE-2023-42282

  • node-ip Ubuntu 24.04 LTS 2.0.0+~1.1.0-1ubuntu1
  • node-ip Ubuntu Pro 18.04 LTS 1.1.5-1ubuntu0.1~esm1
  • node-ip Ubuntu Pro 20.04 LTS 1.1.5-5ubuntu0.1~esm1
  • node-ip Ubuntu Pro 22.04 LTS 1.1.5+~1.1.0-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2023-42282

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nodejs CBL-Mariner 2.0 16.20.2-3
  • nodejs18 CBL-Mariner 2.0 18.18.2-4
  • reaper CBL-Mariner 2.0 3.1.1-10
  • nodejs Azure Linux 3.0 20.14.0-1

azure linux advisories AZL-34379AZL-34380AZL-34439AZL-35042

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-42282 updated cvss 9.8

nodejs-ip: arbitrary code execution via the isPublic() function

  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4
    fixed: vendor fix RHSA-2024:3550
  • Red Hat Migration Toolkit for Virtualization 2.5 migration-toolkit-virtualization/mtv-console-plugin-rhel9 2.5.6-4
    fixed: vendor fix RHBA-2024:1440
  • Red Hat NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9 v1.6.0-66, network-observability/network-observability-operator-bundle 1.6.0-78, network-observability/network-observability-rhel9-operator v1.6.0-66, network-observability/network-observability-ebpf-agent-rhel9 v1.6.0-66, network-observability/network-observability-console-plugin-rhel9 v1.6.0-66, network-observability/network-observability-flowlogs-pipeline-rhel9 v1.6.0-66
    fixed: vendor fix RHSA-2024:3868
  • Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8 3.17-19
    fixed: vendor fix RHSA-2024:10236
  • Red Hat RHDH 1.1 for RHEL 9 rhdh/rhdh-hub-rhel9 1.1-97
    fixed: vendor fix RHEA-2024:1366
  • Red Hat RHODF 4.15 for RHEL 9 odf4/mcg-core-rhel9 v4.15.0-68
    fixed: vendor fix RHSA-2024:1383
show 1 more
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat Migration Toolkit for Virtualization 2.5 migration-toolkit-virtualization/mtv-api-rhel9 2.5.6-8, migration-toolkit-virtualization/mtv-rhel8-operator 2.5.6-9, migration-toolkit-virtualization/mtv-virt-v2v-rhel9 2.5.6-8, migration-toolkit-virtualization/mtv-controller-rhel9 2.5.6-8, migration-toolkit-virtualization/mtv-operator-bundle 2.5.6-22, migration-toolkit-virtualization/mtv-validation-rhel9 2.5.6-9, +7 more Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8 Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel8 3.17-9, devspaces/idea-rhel8 3.17-4, devspaces/server-rhel8 3.17-9, devspaces/traefik-rhel8 3.17-4, devspaces/configbump-rhel8 3.17-4, devspaces/dashboard-rhel8 3.17-25, +5 more
    +3 more products
    Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n Red Hat RHDH 1.1 for RHEL 9 rhdh/rhdh-rhel9-operator 1.1-85, rhdh/rhdh-operator-bundle 1.1-118 Red Hat RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9 v4.15.0-37, odf4/odf-cli-rhel9 v4.15.0-22, odf4/odf-console-rhel9 v4.15.0-57, odf4/mcg-rhel9-operator v4.15.0-39, odf4/ocs-rhel9-operator v4.15.0-79, odf4/odf-rhel9-operator v4.15.0-19, +19 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

1.61% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • cosmosofcyberspace.github.io https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html referenced PoC, tagged "exploit" by a source, unverified
  • huntr.com https://huntr.com/bounties/bfc3b23f-ddc0-4ee7-afab-223b07115ed3/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm ip
>=2.0.0, <2.0.1
<1.1.9
2.0.1
1.1.9

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.