CVE-2026-69198
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The ip-address library for JavaScript versions 10.1.1 through 10.2.2 contains a vulnerability where special-use classification methods (isLoopback, isPrivate, isLinkLocal, isCGNAT, isMulticast, isUnspecified, isBroadcast, isULA, getType) rely on isInSubnet, which returns false when the address's subnet mask is shorter than the reference range's mask. Appending a CIDR suffix like /0 causes all these methods to report an internal address as unremarkable, while correctForm() and address still return the real internal target. Applications using these checks for network trust-boundary decisions, such as SSRF filters, may treat an internal target as external and allow the request. Fixed in version 10.2.2.
Risk Assessment
The risk is bypassing SSRF protections, potentially allowing attackers to send requests to internal resources that should be blocked, leading to data leakage or further attacks.
Recommendation
Upgrade the ip-address library to version 10.2.2 or later immediately. Review application code for usage of these methods and consider additional validations.
Other vulnerabilities in ip-address
See all- CVE-2026-69192High
ip-address is a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. Prior to 10.3.1, Address4 accepts an octet with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo decode a leading zero as octal. This causes a disagreement between the library and the network stack about which host a string names. For example, new Address4('012.0.0.1') reports correctForm() as 12.0.0.1 and isPrivate() as false, but fetch('http://012.0.0.1/') connects to 10.0.0.1.
- CVE-2026-54272Medium
The ip-address library in JavaScript versions 10.1.1 through 10.2.0 is vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. These addresses are incorrectly classified as Global unicast, bypassing isLoopback, isUnspecified, isMulticast, isLinkLocal, and isULA checks. For IPv4-mapped addresses, this is reachable on any dual-stack host; for NAT64, it requires a NAT64/DNS64 gateway.
- CVE-2026-42338Medium
The ip-address library before version 10.1.1 does not HTML-escape attacker-controlled content before embedding it in returned HTML strings. An application passing untrusted input to Address6 and rendering the output as HTML is vulnerable to cross-site scripting.
Original NVD description (English source)
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2.