A critical input validation flaw in the ip-address library enables Server-Side Request Forgery (SSRF) attacks against applications using the component.

The library fails to properly validate IP address inputs (CWE-20), which can be abused to perform Server-Side Request Forgery (CWE-918). This allows an unauthenticated attacker to force the server to perform unintended network requests.

This vulnerability can be leveraged to bypass internal network firewalls, scan internal services, or interact with sensitive cloud metadata services. Given the CVSS score of 7.7, this represents a significant risk to internal infrastructure security and could result in unauthorized access to backend systems and data.

Immediate Action: Update the ip-address dependency to version 10.3.1 or later within your JavaScript projects.

Proactive Monitoring: Monitor outgoing network traffic from servers for anomalous requests to internal IP ranges or metadata services (e.g., 169.254.169.254).

Compensating Controls: Implement strict network egress filtering on servers to prevent unauthorized internal network access, even if the application is compromised.

Public Exploit Available: No

Developers should immediately update the ip-address library to version 10.3.1. Given the potential for SSRF, security teams should also review application code that utilizes this library to ensure that input is validated and that the server's network access is appropriately restricted.