CVE-2025-59436: SSRF
The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59436?
The CVE-2025-59436 vulnerability is classified as a medium severity issue due to its potential for server-side request forgery (SSRF).
How do I fix CVE-2025-59436?
To fix CVE-2025-59436, upgrade the node-ip package to a version above 2.0.1 where the issue has been resolved.
What is the cause of CVE-2025-59436?
CVE-2025-59436 is caused by an improper categorization of the IP address 017700000001 as publicly routable due to an incomplete fix for CVE-2024-29415.
Which versions of the node-ip package are affected by CVE-2025-59436?
Versions of the node-ip package up to and including 2.0.1 are affected by CVE-2025-59436.
Is CVE-2025-59436 related to other vulnerabilities?
Yes, CVE-2025-59436 is related to the incomplete fix for CVE-2024-29415 that initially addressed a similar issue.