The ip package, a utility for working with IP addresses in Node.js, saw a version bump from 1.1.4 to 1.1.5 in early March 2017, after roughly four months since the prior release. Examining the package metadata, the core functionality and developer dependencies appear consistent between the two versions, suggesting the update likely addresses bug fixes or minor improvements rather than introducing significant new features. Both versions leverage the same set of developer tools: jscs and jshint for code style and quality checks, plus mocha for testing. The consistent MIT license and repository details indicate no change in the project's open-source nature or hosting.
For developers considering using the ip package, both versions offer a reliable foundation for IP address manipulation. Given the shared dependencies and apparent lack of major feature additions, choosing between 1.1.4 and 1.1.5 likely hinges on prioritizing the latest bug fixes or adhering to specific dependency constraints within a project. The releaseDate values highlight the ongoing maintenance of the ip package, confirming its sustained relevance within the Node.js ecosystem. It's advisable to review any release notes or associated commit history, if available, for more granular insights into the precise changes implemented in version 1.1.5 to make an informed decision.
All the vulnerabilities related to the version 1.1.5 of the package
NPM IP package incorrectly identifies some private IP addresses as public
The isPublic() function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery (SSRF) if isPublic() is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.
ip SSRF improper categorization in isPublic
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
