PT-2025-37863 · Npm+1 · Ip+1

Emredurmaz4 · Published 2025-09-16 · Updated 2025-09-24 · CVE-2025-59436

Positive Technologies (AI Summary)

CVSS v3.1

3.2

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ip (aka node-ip) versions through 2.0.1

Description The ip (aka node-ip) package may allow Server-Side Request Forgery (SSRF) due to the improper categorization of the IP address value 017700000001 as globally routable via the isPublic function. This issue is related to an incomplete fix for a previously identified issue.

Recommendations Update to a version beyond 2.0.1.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-59436

Affected Products

Debian

Ip

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-59436 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59436 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-59436 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-59436 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59436 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59436 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-59436 · Vendor Advisory
• https://github.com/indutny/node-ip/issues/160 · Note
• https://twitter.com/durmazemre4/status/1970756582750241169 · Twitter Post
• https://twitter.com/CVEnew/status/1967819467141828804 · Twitter Post
• https://t.me/CVEtracker/32586 · Telegram Post
• https://cosmosofcyberspace.github.io/CVE-Application-Document.html · Note