Dev rejects CVE severity, makes his GitHub repo read-only

BleepingComputer details how the maintainer of the widely used 'node-ip' (npm 'ip') package archived its GitHub repo after a CVE (CVE-2023-42282) — originally scored as critical — flagged a parsing issue that can treat private IPs in non-standard formats as public. The author fixed the behavior but disputed the CVE's real-world impact; GitHub lowered the advisory severity while NVD still lists it as critical, and the article frames this case within a larger problem of dubious or noisy CVE reports burdening open-source maintainers.