Executive brief
get-ip-range is a Node.js library used to parse and enumerate IP address ranges. An attacker can cause the application to crash or become unresponsive by supplying an extremely large IP range (such as 128.0.0.0/1) as input, exhausting server memory and CPU resources. This could disrupt services that depend on this library for IP address processing.
Technical details
The vulnerability is a denial-of-service flaw (CWE-400: Uncontrolled Resource Consumption) in get-ip-range versions before 4.0.0. The library does not properly limit the number of IP addresses it attempts to enumerate when processing a range, allowing an attacker to supply a large CIDR block that causes resource exhaustion. The attack requires only network access and untrusted input—no authentication is needed. An attacker can trigger excessive memory allocation and CPU consumption, crashing the affected application. The fix was implemented in version 4.0.0, which limits the total number of IPs that can be enumerated in a range.
Affected products
- npm get-ip-range before 4.0.0
Timeline
- 2021-04-13: disclosed
- 2021-04-13: patched: Fixed in version 4.0.0