CVE-2026-101913

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.

The ip-address library before version 10.7.1 accepts unbounded strings in the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts, expanding invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB.

In the ip-address library from version 10.2.0 to 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range.

The ip-address library for JavaScript versions 10.1.1 through 10.2.2 contains a vulnerability where special-use classification methods (isLoopback, isPrivate, isLinkLocal, isCGNAT, isMulticast, isUnspecified, isBroadcast, isULA, getType) rely on isInSubnet, which returns false when the address's subnet mask is shorter than the reference range's mask. Appending a CIDR suffix like /0 causes all these methods to report an internal address as unremarkable, while correctForm() and address still return the real internal target. Applications using these checks for network trust-boundary decisions, such as SSRF filters, may treat an internal target as external and allow the request. Fixed in version 10.2.2.

ip-address is a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. Prior to 10.3.1, Address4 accepts an octet with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo decode a leading zero as octal. This causes a disagreement between the library and the network stack about which host a string names. For example, new Address4('012.0.0.1') reports correctForm() as 12.0.0.1 and isPrivate() as false, but fetch('http://012.0.0.1/') connects to 10.0.0.1.

The ip-address library in JavaScript versions 10.1.1 through 10.2.0 is vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. These addresses are incorrectly classified as Global unicast, bypassing isLoopback, isUnspecified, isMulticast, isLinkLocal, and isULA checks. For IPv4-mapped addresses, this is reachable on any dual-stack host; for NAT64, it requires a NAT64/DNS64 gateway.

The ip-address library before version 10.1.1 does not HTML-escape attacker-controlled content before embedding it in returned HTML strings. An application passing untrusted input to Address6 and rendering the output as HTML is vulnerable to cross-site scripting.