Additional SSRF Bypass: Octal Format ("017700000001")

Nobody has claimed this yet.

Summary
An additional critical SSRF bypass vulnerability affecting the ip.isPublic() function that was not covered in the existing Issue #150 or Issue #160.
Vulnerability Details
The input "017700000001" (32-bit octal format) is incorrectly classified as a public IP address, allowing SSRF bypass attacks:
const ip = require('ip');

console.log(ip.isPublic("017700000001")); // true ❌ (should be false)
console.log(ip.isPrivate("017700000001")); // false ❌ (should be true)

// Correct behavior:
console.log(ip.isPublic("127.0.0.1")); // false ✅

Impact
Severity: Critical SSRF bypass
Attack vector: http://017700000001:port/path URLs bypass IP validation
Network behavior: "017700000001" (octal) = 2130706433 (decimal) = 127.0.0.1 (localhost)
Format explanation: 32-bit octal representation where entire IPv4 address is encoded as single octal number.

Proof of Concept
// Typical vulnerable application
function makeRequest(userUrl) {
const hostname = new URL(userUrl).hostname;

if (ip.isPublic(hostname)) {
return fetch(userUrl); // BYPASSED!
}
throw new Error("Private IP blocked");
}

// Attack succeeds:
makeRequest("http://017700000001:3000/admin"); // Accesses localhost:3000

Technical Analysis
The vulnerability stems from insufficient validation of alternative IP address representations:
// Octal to decimal conversion:
parseInt("017700000001", 8); // 2130706433
// Decimal to IP conversion:
// 2130706433 = (127 << 24) + (0 << 16) + (0 << 8) + 1 = 127.0.0.1

Relationship to Existing Issues
This octal format bypass complements the other techniques reported in:
Issue #150 (127.1, 127.0.1, fe80::0001, etc.)
Issue #160 (null route "0")
But was not included in those lists, representing an additional attack vector.

Affected Version
Package: ip@2.0.1 (current latest)
Downloads: 5+ million weekly
Impact scope: All applications using ip.isPublic() for SSRF protection
CVE Assignment
CVE-2025-59436 has been assigned for this vulnerability
CVE Database: https://nvd.nist.gov/vuln/detail/CVE-2025-59436
Severity: Critical (despite initial LOW scoring by MITRE - under review)

Request: Please consider addressing this octal format bypass alongside the other reported bypass techniques for comprehensive security coverage.

Start by inspecting the ip.isPublic() and ip.isPrivate() entry points and the existing handling described in Issues #150 and #160. Verify how the octal value "017700000001" is classified, then add coverage for the reported behavior; done means it is rejected as private rather than accepted as public.

Written by the indexing model from the issue text.