CVE-2026-54272
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The ip-address library in JavaScript versions 10.1.1 through 10.2.0 is vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. These addresses are incorrectly classified as Global unicast, bypassing isLoopback, isUnspecified, isMulticast, isLinkLocal, and isULA checks. For IPv4-mapped addresses, this is reachable on any dual-stack host; for NAT64, it requires a NAT64/DNS64 gateway.
Risk Assessment
The organization risks SSRF attacks that could allow an attacker to access internal network resources, bypassing security controls.
Recommendation
Update the ip-address library to version 10.2.1, which contains the fix.
Other vulnerabilities in ip-address
See all- CVE-2026-69198Medium
The ip-address library for JavaScript versions 10.1.1 through 10.2.2 contains a vulnerability where special-use classification methods (isLoopback, isPrivate, isLinkLocal, isCGNAT, isMulticast, isUnspecified, isBroadcast, isULA, getType) rely on isInSubnet, which returns false when the address's subnet mask is shorter than the reference range's mask. Appending a CIDR suffix like /0 causes all these methods to report an internal address as unremarkable, while correctForm() and address still return the real internal target. Applications using these checks for network trust-boundary decisions, such as SSRF filters, may treat an internal target as external and allow the request. Fixed in version 10.2.2.
- CVE-2026-69192High
ip-address is a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. Prior to 10.3.1, Address4 accepts an octet with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo decode a leading zero as octal. This causes a disagreement between the library and the network stack about which host a string names. For example, new Address4('012.0.0.1') reports correctForm() as 12.0.0.1 and isPrivate() as false, but fetch('http://012.0.0.1/') connects to 10.0.0.1.
- CVE-2026-42338Medium
The ip-address library before version 10.1.1 does not HTML-escape attacker-controlled content before embedding it in returned HTML strings. An application passing untrusted input to Address6 and rendering the output as HTML is vulnerable to cross-site scripting.
Original NVD description (English source)
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.