Chainfedorindutny · ipnpm:ip
fedorindutny ip: incomplete fixes (2023–2025)
4 CVEs over 3 generations, 8 Feb 2024 to 16 Sep 2025.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2023-422828 Feb 2024 First in the chain
- CVE-2024-2941527 May 2024 incomplete fix for CVE-2023-42282
- CVE-2025-5943616 Sep 2025 incomplete fix for CVE-2024-29415
- CVE-2025-5943716 Sep 2025 incomplete fix for CVE-2024-29415
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2023-42282 | 8 Feb 2024 | The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly… | First in chain | 22.0 |
| CVE-2024-29415 | 27 May 2024 | The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567… | CVE-2023-42282 · incomplete fix · High | 29.7 |
| CVE-2025-59436 | 16 Sep 2025 | The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is… | CVE-2024-29415 · incomplete fix · High | 2.7 |
| CVE-2025-59437 | 16 Sep 2025 | The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 0 is improperly… | CVE-2024-29415 · incomplete fix · High | 2.7 |