CVE-2024-29415: Fedorindutny IP

High severity, CVSS 8.1. EPSS: 8.3% chance of exploitation in the next 30 days.

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

Affected products

• Fedorindutny IP: before 2.0.1 (fixed in 2.0.1)

Published 2024-05-27. Last modified 2026-06-17.