ip SSRF improper categorization in isPublic - IP node package vulnerability

I found an IP SSRF improper categorization from the isPublic vulnerability. When I tried npm audit to get the vulnerability report, I found the below vulnerability related to the ip package:

ip *
Severity: high
ip SSRF improper categorization in isPublic - https://github.com/advisories/GHSA-2p57-rm9w-gvfp
fix available via npm audit fix --force
Will install @angular-devkit/build-angular@18.0.4, which is a breaking change
node_modules/ip
dns-packet <=5.2.4
Depends on vulnerable versions of ip
node_modules/dns-packet
multicast-dns 6.0.0 - 7.2.2
Depends on vulnerable versions of dns-packet
node_modules/multicast-dns
bonjour >=3.3.1
Depends on vulnerable versions of multicast-dns
node_modules/bonjour
socks 1.0.0 - 2.7.1
Depends on vulnerable versions of ip
node_modules/socks
socks-proxy-agent 1.0.1 - 4.0.2
Depends on vulnerable versions of socks
node_modules/socks-proxy-agent


For my project, I am using:

• Angular CLI: 9.1.13
• Node: 22.2.0
• OS: win32 x64

As I am using Angular version 9.1.13, moving to Angular 18 will cause breaking changes, So I have tried overriding the ip package to 2.0.1 in the package.json file:

"overrides": {
"webpack-dev-server":{
"ip": "^2.0.1",
},
"dns-packet": {
"ip": "^2.0.1"
},
"socks": {
"ip": "^2.0.1"
}
}


This will update the ip package but the vulnerability is still not resolved. Updating the Angular version will not help for me, please help me if you found such vulnerability and were able to resolve it.

Continue reading...