CVE-2023-42282

CVE-2023-42282 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting the Node.js 'ip' package (versions before 1.1.9). It arises because certain IP addresses, like 0x7f.1, are incorrectly classified as globally routable by the 'isPublic' function. This flaw carries a CVSS score of 9.8 (Critical), indicating a severe risk with network-based attacks requiring no user interaction, potentially leading to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, suggesting a high level of awareness and potential for future exploitation.