CVE-2025-8020: private-ip vulnerable to Server-Side Request Forgery

The vulnerability exists because the private-ip package does not correctly identify multicast IP addresses as being part of a reserved range. The analysis of the source code in src/index.ts confirms the findings from the security advisories. The PRIVATE_IP_RANGES array, which is fundamental to the package's logic, is missing the 224.0.0.0/4 multicast block. The ipv4_check function directly uses this incomplete list to validate IPv4 addresses. The main default exported function serves as the entry point and directs IPv4 input to the flawed ipv4_check function. Consequently, any application using this package for SSRF protection can be bypassed by an attacker using a multicast IP address. The vulnerable functions are the default exported function, which is the main entry point, and the ipv4_check function, which contains the flawed logic.