VULNERABILITY INTELLIGENCE
CVE-2024-29415
CVSS score8.1 HIGH
EPSS probability8.28%
CISA KEVNot currently listed
Published2024-05-27
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-918