CVE catalog

CVE-2025-59436

node-ip: CVE-2025-59436

[CVE catalog]

Severity
Low · CVSS 3.2CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.12% · Oct 25, 2026

The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-ipsid2.0.1+~1.1.3-3vulnerable
Debiannode-ipforky2.0.1+~1.1.3-3vulnerable
Debiannode-iptrixie2.0.1+~1.1.3-3vulnerable
Debiannode-ipbookworm2.0.0+~1.1.0-1not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-ipsourcesid(unfixed)not yet assignedNot reported[1119019]
Debiannode-ipsourceforky(unfixed)not yet assignedNot reported[1119019]
Debiannode-ipsourcetrixie(unfixed)not yet assignedNot reported[1119019]
Debiannode-ipsourcebookwormNot affectedunimportantNot reported[1119019]

[Debian bug #1119019]

Notes

[trixie] node-ip: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [node-ip]Affected
    Details (2)

    • 2.0.1+~1.1.3-3 · all · trixie

      Affected

      dsa · node-ip · debian · 13

    • 2.0.1+~1.1.3-3 · all · trixie

      Affected

      dsa · node-ip · debian · 13

[Debian 12 (Bookworm)]

  • [node-ip]Not affected
    Details (2)

    • 2.0.0+~1.1.0-1 · all · bookworm

      Not affected

      dsa · node-ip · debian · bookworm

    • 2.0.0+~1.1.0-1 · all · bookworm

      Not affected

      dsa · node-ip · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]