CVE-2021-27191: Insufficient Information (NVD-CWE-noinfo)
value: The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2021-02-11T18:15Z
Repository: https://github.com/JoeScho/get-ip-range
Language: TypeScript
Files changed: index.test.ts, index.ts
Commit date: 2021-02-10 22:48:28 +0000
Commit message: limit total IPs in range to avoid DoS

Diff: diff --git a/index.test.ts b/index.test.ts
index 339c16b..29e2c93 100644
--- a/index.test.ts
+++ b/index.test.ts
@@ -89,6 +89,18 @@ describe('for two IP addresses', () => {
   });
 
   it('should support hyphenated range in IPv5', () => {
     expect(getIPRange('::ffff:102:304-::ffff:102:307')).toEqual(successResponsev6);
   });
+
+  it('should throw if the range is greater than 10000 default', () => {
+    const throwFn = () => getIPRange('128.0.0.0/1');
+    expect(throwFn).toThrow('Too many IPs in range. Total number: 2147483647. Max count is 10000, to increase, set the limit with the MAX_RANGE environment variable');
+  });
+
+  it('should throw if the range is greater than process.env.MAX_RANGE', () => {
+    process.env.MAX_RANGE = '5000';
+
+    const throwFn = () => getIPRange('128.0.0.0/1');
+    expect(throwFn).toThrow('Too many IPs in range. Total number: 2147483647. Max count is 5000, to increase, set the limit with the MAX_RANGE environment variable');
+  });
 });
diff --git a/index.ts b/index.ts
index 369bab1..14d5ac3 100644
--- a/index.ts
+++ b/index.ts
@@ -1,9 +1,12 @@
 import { toLong, fromLong } from 'ip';
 // @ts-ignore
 import { Address4, Address6 } from 'ip-address';
 
+// Set default max range
+let maxRange = 10000;
+
 const getIPv4 = (ip: string): Address4 | null => {
   try {
     return new Address4(ip);
   } catch (err) {
     return null;
@@ -22,10 +25,17 @@ const getRangev4 = (ip1: string, ip2: string) => {
   const ips = [];
 
   let firstAddressLong = toLong(ip1);
   const lastAddressLong = toLong(ip2);
 
+  const totalIPs = lastAddressLong - firstAddressLong;
+
+  // Prevent DoS
+  if (totalIPs > maxRange) {
+    throw new Error(`Too many IPs in range. Total number: ${totalIPs}. Max count is ${maxRange}, to increase, set the limit with the MAX_RANGE environment variable`)
+  }
+
   for (firstAddressLong; firstAddressLong <= lastAddressLong; firstAddressLong++)
     ips.push(fromLong(firstAddressLong));
 
   return ips;
 };
@@ -46,10 +56,12 @@ const getRangev6 = (ip1: string, ip2: string) => {
 const isCIDR = (ipCIDR: Address4 | Address6): boolean => Boolean(ipCIDR.parsedSubnet);
 
 const isRange = (ipRange: string): boolean => ipRange.indexOf('-') !== -1;
 
 const getIPRange = (ip1: string, ip2?: string): Array<string> => {
+  maxRange = parseInt(process.env.MAX_RANGE || '10000');
+
   const ip1v4 = getIPv4(ip1);
   const ip1v6 = getIPv6(ip1);
 
   //
   // Two IPs

Fixed code: 
  it('should throw if the range is greater than 10000 default', () => {
    const throwFn = () => getIPRange('128.0.0.0/1');
    expect(throwFn).toThrow('Too many IPs in range. Total number: 2147483647. Max count is 10000, to increase, set the limit with the MAX_RANGE environment variable');
  });

  it('should throw if the range is greater than process.env.MAX_RANGE', () => {
    process.env.MAX_RANGE = '5000';

    const throwFn = () => getIPRange('128.0.0.0/1');
    expect(throwFn).toThrow('Too many IPs in range. Total number: 2147483647. Max count is 5000, to increase, set the limit with the MAX_RANGE environment variable');
  });
// Set default max range
let maxRange = 10000;

  const totalIPs = lastAddressLong - firstAddressLong;

  // Prevent DoS
  if (totalIPs > maxRange) {
    throw new Error(`Too many IPs in range. Total number: ${totalIPs}. Max count is ${maxRange}, to increase, set the limit with the MAX_RANGE environment variable`)
  }

  maxRange = parseInt(process.env.MAX_RANGE || '10000');