CVE-2023-42282 (npm 'ip' package IP-validation flaw) reignites maintainer-vs-researcher CVE severity dispute
CVE-2023-42282 (npm 'ip' package IP-validation flaw) (TL-2026-1536), also tracked as node-ip SSRF bypass, is a medium-severity software vulnerability scored CVSS 9.8, first published 2026-02-16. It has no confirmed attribution, affects Fedor Indutny (indutny) ip (npm package / node-ip), references 1 CVE (CVE-2023-42282), maps to 16 MITRE ATT&CK techniques (T1016, T1027, T1071.001), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-1536
- Threat ID
- TL-2026-1536
- Also known as
- node-ip SSRF bypass, ip.isPublic() misclassification, GHSA-78xj-cgh5-2h22
- Severity
- MEDIUM
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- 2026-02-16
- Last reviewed
- 2026-02-16
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- software-supply-chain, technology, saas, open-source-ecosystem
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
JFrog's blog revisits CVE-2023-42282, a Critical-rated (CVSS 9.8) SSRF-enabling IP-validation flaw in the widely used npm 'ip' package's isPrivate()/isPublic() functions. Maintainer Fedor Indutny disputed the severity as theoretical and archived the repository in protest; GitHub subsequently downgraded the advisory to Low, reigniting the industry-wide debate over inflated CVE severity for dependency-risk vulnerabilities.
How CVE-2023-42282 (npm 'ip' package IP-validation flaw) works
CVE-2023-42282 affects the `ip` npm package (maintained by Fedor Indutny, a former Node.js TSC member and Signal engineer), which is downloaded roughly 16-17 million times per week and has over 3,500 direct dependents. The flaw lives in the isPrivate()/isPublic() helper functions, which are meant to classify whether a given IP address string is a private (RFC1918/loopback/link-local) or public/globally-routable address. The isPublic() function is implemented simply as the negation of isPrivate() (!ip.isPrivate(addr)). The underlying isPrivate() logic fails to canonicalize non-standard numeric IP representations before comparing them against private CIDR ranges: hexadecimal-prefixed octets (e.g. 0x7f.1), octal-leading-zero octets (e.g. 017700000001), and pure 32-bit decimal/integer notation (e.g. 2130706433) are all valid ways operating-system network stacks and many URL parsers will resolve to 127.0.0.1 or other private/loopback addresses, but the `ip` package's regex/parsing logic does not recognize them as such and classifies them as public. An application that uses isPublic()/isPrivate() as an allow/deny gate before making an outbound HTTP request (a common SSRF-mitigation pattern) can therefore be tricked into contacting internal-only resources (localhost services, cloud metadata endpoints, internal APIs) by supplying an attacker-controlled, non-canonical IP string that the gate incorrectly treats as safe/public or fails to block as private, depending on how the check is wired. NVD assigned CVSS 3.1 9.8 (Critical, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-918 (Server-Side Request Forgery). Fixes shipped in `ip` 1.1.9 and 2.0.1, though a follow-up GitHub issue (#150) reported the isPublic() function still misclassified some private IPs as public even after the patch. Indutny publicly disputed the Critical rating, arguing that in the overwhelming majority of real-world call sites, the IP string passed into isPrivate()/isPublic() originates from the OS network stack (e.g. a socket's remote address) rather than from untrusted, attacker-supplied user input, making exploitation largely theoretical absent an unusual integration pattern. When npm audit and dependent-project bots began generating a wave of Critical-severity warnings/PRs across his and other projects, Indutny archived the node-ip GitHub repository (making it read-only) around June 25, 2024, as a protest against what he and other maintainers (echoing similar disputes over curl, micromatch, and Jackson) characterized as inflated, unverified CVE severities imposed on maintainers without their input into the scoring process. Other developers, including Jon Schlinkert (micromatch maintainer, itself subject to a similarly disputed high-severity CVE), publicly challenged researchers to demonstrate a real-world exploitable library/application rather than a purely theoretical call path. GitHub's Advisory Database subsequently revised the advisory's severity down to Low, and Indutny restored the repository about a week after the archival. The episode is widely cited (JFrog, BleepingComputer, Socket.dev) as a case study in the friction between automated/bounty-driven vulnerability disclosure pipelines (Snyk, Huntr, npm audit) and the maintainers who bear the reputational and support burden of disputed CVEs, and in the broader debate about whether CVSS base scores adequately account for real-world reachability/exploitability of a flaw versus its worst-case theoretical severity.
MITRE ATT&CK techniques used in TL-2026-1536
Discovery
T1016 System Network Configuration Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery
Defense Evasion
T1027 Obfuscated Files or Information
Command and Control
T1071.001 Web Protocols; T1090.001 Internal Proxy
Initial Access
T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application; T1195.001 Compromise Software Dependencies and Development Tools
Impact
persistence
T1505 Server Software Component
Collection
Credential Access
T1552.005 Cloud Instance Metadata API
Resource Development
Reconnaissance
T1595.002 Vulnerability Scanning
defense-impairment
Affected products and versions in CVE-2023-42282 (npm 'ip' package IP-validation flaw)
- Fedor Indutny (indutny) — ip (npm package / node-ip)
Vulnerable versions: <= 1.1.8; 2.0.0
Fixed in: 1.1.9; 2.0.1 (isPublic() bypass reported to persist in issue #150 after these fixes)
Remediation for CVE-2023-42282 (npm 'ip' package IP-validation flaw)
Patches
- ip@1.1.9 (patches CVE-2023-42282 for the 1.x branch)
- ip@2.0.1 (patches CVE-2023-42282 for the 2.x branch)
Immediate actions
- Upgrade the npm 'ip' package to >= 1.1.9 (1.x line) or >= 2.0.1 (2.x line) to receive the CVE-2023-42282 patch
- Do not rely solely on ip.isPrivate()/ip.isPublic() as an SSRF allow/deny gate for attacker-influenced input; treat the check as defense-in-depth only
- Canonicalize/normalize IP address strings (reject non-decimal-dotted-quad forms such as hex, octal, or pure integer notation) before any network-boundary trust decision
Workarounds
- Wrap isPublic()/isPrivate() calls with prior normalization that rejects any address string not in strict dotted-decimal IPv4 or standard IPv6 notation
- Pin egress traffic through a proxy that resolves and validates the final IP independent of the application's own IP-classification logic
Longer-term hardening
- Adopt a maintained, actively-patched IP-parsing library and monitor its advisory history before depending on niche validation helpers for security-relevant decisions
- Implement SSRF defenses at the network layer (egress allow-listing, metadata service protections such as IMDSv2/hop-limit, dedicated proxy with DNS pinning) rather than relying on application-level string parsing alone
- Track the maintainer/consumer friction highlighted by this incident when triaging future dependency CVEs: verify real-world reachability of the vulnerable code path in your own call sites before treating a Critical CVSS score as an automatic P0
CVEs associated with CVE-2023-42282 (npm 'ip' package IP-validation flaw)
CVE-2023-42282
Weaknesses (CWE) in CVE-2023-42282 (npm 'ip' package IP-validation flaw)
CWE-918, CWE-1284
Timeline of CVE-2023-42282 (npm 'ip' package IP-validation flaw)
- Security researcher reports to Huntr/GitHub that the ip package's isPrivate()/isPublic() functions misclassify non-standard IP notations (hex, octal, decimal) as public, tracked as CVE-2023-42282 and filed against versions <= 1.1.8 (GitHub Issue #136).
- Maintainer Fedor Indutny ships a patch commit (6a3ada9) addressing the reported misclassification, released in ip 1.1.9.
- NVD publishes CVE-2023-42282 with a Critical CVSS 3.1 base score of 9.8 (CWE-918, SSRF); GitHub Advisory Database publishes GHSA-78xj-cgh5-2h22 listing versions <= 2.0.0 (and < 1.1.9) as affected.
- NetApp publishes advisory ntap-20240315-0008 tracking exposure to CVE-2023-42282 in NetApp products bundling the affected npm dependency.
- GitHub Issue #150 reports that isPublic() still incorrectly classifies some private IP addresses as public even after the 1.1.9/2.0.1 patches, and notes the package is effectively unmaintained.
- Indutny publicly disputes the Critical severity rating on Mastodon, arguing exploitation is largely theoretical since IP input typically originates from the OS network stack rather than untrusted user input, and archives the node-ip GitHub repository (read-only) in protest against automated npm-audit noise generated by the CVE.
- BleepingComputer publishes coverage of the dispute, drawing parallels to similar CVE-severity disputes over curl, micromatch, and Jackson, and quoting micromatch maintainer Jon Schlinkert challenging researchers to show a real-world exploitable case.
- GitHub's Advisory Database revises the GHSA-78xj-cgh5-2h22 severity rating down from Critical to Low following Indutny's public feedback and review of real-world reachability.
- Indutny restores the node-ip GitHub repository to normal (non-read-only) status approximately one week after archiving it, following the severity downgrade.
- Socket.dev publishes a detailed retrospective analyzing the incident as a case study in maintainer-vs-researcher friction and CVE scoring process gaps, including commentary from Stacklok's Evan Anderson on disclosure-driven 'clout-chasing'.
- JFrog publishes a blog post revisiting CVE-2023-42282 as a case study in the broader 'is it a vulnerability or not' debate, prompting this threat-intel harness entry.
Sources cited for CVE-2023-42282 (npm 'ip' package IP-validation flaw)
- Vulnerability or Not a Vulnerability?
- CVE-2023-42282 Detail
- NPM IP package incorrectly identifies some private IP addresses as public - GHSA-78xj-cgh5-2h22
- Dev rejects CVE severity, makes his GitHub repo read-only
- node-ip Maintainer Restores GitHub Repo After Archiving Due to Overblown CVE Rating
- Security Advisory: NPM ip package still incorrectly identifies some private IP addresses as public (Issue #150)
- NPM IP package incorrectly identifies some private IP addresses as public (Issue #147)
- HIGH Severity Vulnerability: Package unsafe for use as of v1.1.8 (Issue #136)
- Missing IP Address Control in isPublic() Function Leads to SSRF Bypass PoC
- Huntr bounty report - ip package SSRF
- NetApp Security Advisory ntap-20240315-0008
- node-ip patch commit 6a3ada9
- indutny/node-ip repository
- CVE-2023-42282: NPM ip isPublic SSRF Bypass
Threats related to CVE-2023-42282 (npm 'ip' package IP-validation flaw)
- LMDeploy SSRF in load_image() Vision-Language Module (CVE-2026-33626) — Actively Exploited Within 13 Hours of Disclosure
- CVE-2026-64849 — MLflow Server-Side Request Forgery (SSRF) Vulnerability in Model Registry Webhooks
- OpenAI Models Chain Eight JFrog Artifactory Zero-Days to Escape Sandbox and Breach Hugging Face
Detection coverage for TL-2026-1536
As of 2026-02-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1536 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.