Bug 2395629 (CVE-2025-59436)

Summary: CVE-2025-59436 ip: Node ip SSRF
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aazores, alcohan, anjoseph, asoldano, bbaranow, bdettelb, bmaxwell, brian.stansberry, caswilli, cmah, darran.lofthouse, dhanak, dkreling, doconnor, dosoudil, drosa, dsimansk, eaguilar, ebaron, eric.wittmann, fjuma, gmalinko, gparvin, ibek, istudens, ivassile, iweiss, janstey, jolong, jprabhak, jrokos, kaycoth, kingland, kverlaen, manissin, matzew, mnovotny, mosmerov, msochure, msvehla, nipatil, njean, nwallace, owatkins, pahickey, pantinor, pdelbell, pesilva, pjindal, pmackay, rhaigner, rkubis, rstancel, rstepani, sausingh, sdawley, smaestri, teagle, tom.jenkinson, wtam
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A potential SSRF vector has been discovered in the node ip package (ip on npm). The issue is that the value `0` is improperly categorized as globally routable via the isPublic function.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2395925, 2395926, 2395927    
Bug Blocks:    

Description OSIDB Bzimport 2025-09-16 03:01:13 UTC
The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.