SSRF Vulnerability in Node-ip Package Affects Multiple Applications

CVE-2025-59437

What is CVE-2025-59437?

The node-ip package, used in various applications, contains a vulnerability that may permit Server-Side Request Forgery (SSRF) due to the improper classification of the IP address value 0 as globally routable. While newer application versions typically prevent connections to the IP address 0.0.0.0, there are scenarios influenced by the combination of application version and operating system where such connections may be misinterpreted as local connections, potentially resulting in unexpected behavior and exposing systems to possible attacks.

References