The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such…
Priority MEDIUM 48CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.08279 94th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | ip (npm) | up to 2.0.1 | — | No fix listed | GHSA-2p57-rm9w-gvfp |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- ip (npm) Vendor— Affected up to 2.0.1 Fixed in — No fix listed GHSA-2p57-rm9w-gvfp
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fedorindutny:ip:*:*:*:*:*:node.js:*:* | — | — | fedorindutny |
- cpe:2.3:a:fedorindutny:ip:*:*:*:*:*:node.js:*:* Versions — — ·fedorindutny
Remediation
Red Hat 1 advisory
- RHSA-2024:10236 Released 2024-11-25 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.17.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/dashboard-rhel8, devspaces/udi-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Out of support scope |
| Red Hat Discovery 1 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2024:10236 |
Not affected: 28 products
- Cryostat 2
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Network Observability Operator
- Node HealthCheck Operator
- OpenShift Service Mesh 2
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Developer Hub 1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces 3
- Red Hat OpenShift GitOps
- Red Hat OpenShift distributed tracing 2
- Red Hat Openshift Container Storage 4
- Red Hat Process Automation 7
- Red Hat Satellite 6
- Red Hat Software Collections
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apicurio Registry 2
Timeline
- 2026-10-02 Threatist record created from CVE-2024-29415
- 2026-10-03 Alias added: GHSA-2p57-rm9w-gvfp
- 2026-10-27 Affected versions changed · Red Hat
References
Sources
- CVE-2024-29415 · CVE Program
- CVE-2024-29415 · NVD
- FIRST EPSS
- GHSA-2p57-rm9w-gvfp · GitHub Advisory Database · CC BY 4.0
- CVE-2024-29415 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences