CVE-2025-8020: private-ip vulnerable to Server-Side Request Forgery

July 23, 2025 (updated September 25, 2025)

All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package’s source code.

References

gist.github.com/lirantal/ed18a4493ca9fe4429957c79454a9df1
github.com/advisories/GHSA-9h3q-32c7-r533
github.com/frenchbread/private-ip
nvd.nist.gov/vuln/detail/CVE-2025-8020
security.snyk.io/vuln/SNYK-JS-PRIVATEIP-9510757

Code Behaviors & Features

Detect and mitigate CVE-2025-8020 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →