Executive brief
private-ip is a popular npm library used to validate whether an IP address is private and should be blocked from external network access. The library fails to recognize multicast IP addresses (224.0.0.0/4) as non-private, allowing attackers to bypass SSRF protections that rely on this library. An application using private-ip to validate URLs before fetching remote content could be tricked into accessing multicast addresses that should be forbidden.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) bypass in the private-ip npm package (CWE-918). The library maintains a hardcoded allowlist of private IP ranges but omits the multicast address range 224.0.0.0/4. An attacker can provide a hostname or IP in the multicast range (e.g., 239.255.255.250) which the library incorrectly classifies as public, bypassing SSRF protections. The attack requires no authentication or user interaction—any application using private-ip to validate URLs for fetching remote resources is vulnerable. All versions up to and including 3.0.2 are affected. A fix requires adding the missing multicast range to the private IP ranges array.
Affected products
- private-ip private-ip all versions up to and including 3.0.2
Timeline
- 2025-07-23: disclosed: Advisory GHSA-9h3q-32c7-r533 published