Read the docs
TI-2025-36987 Aliases CVE-2025-59436GHSA-qf5v-q897-m77r

Server-side request forgery in fedorindutny ip

Priority MEDIUM 49CWE-918Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 3 fixed, 18 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00124 2nd percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 3 fixed, 18 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fedorindutnyipup to 2.0.1—No fix listedCNA
  • ip Vendorfedorindutny Affected up to 2.0.1 Fixed in — No fix listed CNA

Remediation

Red Hat 3 advisories

  • RHSA-2026:83548 Released 2026-10-15 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2026:62115 Released 2026-09-01 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:8568 Released 2026-04-16 · Red Hat rating Moderate
    New container image: rhceph-9.0
    • Red Hat Ceph Storage 9.0 registry.redhat.io/rhceph/rhceph-9-rhel9

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet: Fix deferred
Multicluster Engine for KubernetesAffectedNo fix yet: Fix deferred
Network Observability OperatorAffectedNo fix yet: Fix deferred
Node HealthCheck OperatorAffectedNo fix yet: Fix deferred
OpenShift ServerlessAffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat OpenShift GitOpsAffectedNo fix yet: Fix deferred
Red Hat Openshift Data Foundation 4AffectedNo fix yet: Fix deferred
Red Hat Process Automation 7AffectedNo fix yet: Fix deferred
Red Hat build of Apicurio Registry 2AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7.1Fixed RHSA-2026:83548
Red Hat Ceph Storage 8.1Fixed RHSA-2026:62115
Red Hat Ceph Storage 9.0Fixed RHSA-2026:8568
Not affected: 3 products
  • Red Hat Ceph Storage 7.1
  • Red Hat Ceph Storage 8.1
  • Red Hat Ceph Storage 9.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59436
  2. 2026-10-03 Alias added: GHSA-qf5v-q897-m77r
  3. 2026-10-16 Fix available: RHSA-2026:83548 · Red Hat
  4. 2026-10-16 Fix available: Red Hat Ceph Storage 7.1 · Red Hat
  5. 2026-11-06 Fix available: RHSA-2026:8568 · Red Hat

References

Other 2

  • TI-2023-22552 The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such… CVSS 3.1CRITICAL 9.8
  • TI-2025-36988 Server-side request forgery in fedorindutny ip CVSS 3.1LOW 3.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences