AIKIDO-2026-770647

ip-range-check is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)GHSA-87xc-4hwr-pxf6 Published Aug 10, 2026

Medium Risk

This Affects:

ip-range-check

0.0.1 - 0.2.0

Fixed in 0.2.1

Are you affected? Scan for Free

TL;DR

The ipRangeCheck function is commonly used as a guard to block requests to private or internal IP ranges as a defense against Server-Side Request Forgery. It treats any address its bundled parser cannot parse as not matching any range and returns false, and that parser rejects abbreviated or non-canonical IPv4 forms such as 127.1, 0177.1, and 127.0x1. Because operating system resolvers still route these forms to the corresponding private address, a denylist built on the function is bypassed when one of these forms is supplied as the target host, reaching loopback, RFC1918, or cloud metadata addresses. The fix parses these notations using the same inet_aton rules the network stack applies so the check agrees with what the address actually resolves to.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use ipRangeCheck as a security guard to block private or internal IP ranges with an untrusted, unnormalized host string that is also passed to the code that opens the connection.