Read the docs
TI-2026-39172 Aliases CVE-2026-54272GHSA-22jq-vg5j-6vgg

ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

Priority HIGH 70CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 25 fixed, 12 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.

Summary

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Fix Partial ip-address (beaugunderson): 10.2.1ip-address (npm): 10.2.1Red Hat: 27 advisoriesRed Hat: 25 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
beaugundersonip-address10.1.1 to before 10.2.110.2.1Patch availableCNA
—ip-address (npm)10.1.1 to before 10.2.110.2.1Patch availableGHSA-22jq-vg5j-6vgg
  • ip-address Vendorbeaugunderson Affected 10.1.1 to before 10.2.1 Fixed in 10.2.1 Patch available CNA
  • ip-address (npm) Vendor— Affected 10.1.1 to before 10.2.1 Fixed in 10.2.1 Patch available GHSA-22jq-vg5j-6vgg

Remediation

  • Fix · CNA ip-address (beaugunderson) Fixed in 10.2.1
  • Fix · GHSA-22jq-vg5j-6vgg ip-address (npm) Fixed in 10.2.1 Advisory →

Red Hat 27 advisories

  • RHSA-2026:69248 Released 2026-09-21 · Red Hat rating Important
    Red Hat Developer Hub 1.9.9 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:68754 Released 2026-09-17 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.1 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +2
  • RHSA-2026:66003 Released 2026-09-09 · Red Hat rating Important
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
Show 24 more Red Hat advisories
  • RHSA-2026:63046 Released 2026-09-08 · Red Hat rating Important
    OpenShift Container Platform 4.21.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9, registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9-operator +6
  • RHSA-2026:63096 Released 2026-09-08 · Red Hat rating Important
    OpenShift Container Platform 4.22.13 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/aws-node-termination-handler-rhel9 +47
  • RHSA-2026:63103 Released 2026-09-08 · Red Hat rating Important
    OpenShift Container Platform 4.20.37 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-prometheus-rhel9 +1
  • RHSA-2026:62851 Released 2026-09-02 · Red Hat rating Important
    Red Hat Developer Hub 1.10.4 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:62416 Released 2026-09-02 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.aarch64::nodejs:22, nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.ppc64le::nodejs:22, nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.s390x::nodejs:22 +28
  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:59593 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.17.2 security update
    • multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +6
  • RHSA-2026:59583 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.27.3 for Red Hat OpenShift Service Mesh 3.4
    • Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:59579 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.14 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +17
  • RHSA-2026:59566 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:59561 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.11.16 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:59559 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.7 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +15
  • RHSA-2026:59558 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.10 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9 +20
  • RHSA-2026:59554 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.17.13 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:59548 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.4.22 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:58819 Released 2026-08-24 · Red Hat rating Important
    nodejs24 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.18.0-5.el10_2, nodejs24-devel-1:24.18.0-5.el10_2, nodejs24-docs-1:24.18.0-5.el10_2 +3
  • RHSA-2026:56357 Released 2026-08-18 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:56338 Released 2026-08-18 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:55603 Released 2026-08-17 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.18.0-6.module+el9.8.0+24638+75f46aee.aarch64::nodejs:24, nodejs-1:24.18.0-6.module+el9.8.0+24638+75f46aee.ppc64le::nodejs:24, nodejs-1:24.18.0-6.module+el9.8.0+24638+75f46aee.s390x::nodejs:24 +25
  • RHSA-2026:55601 Released 2026-08-17 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.23.1-3.module+el9.8.0+24637+e0b636e5.aarch64::nodejs:22, nodejs-1:22.23.1-3.module+el9.8.0+24637+e0b636e5.ppc64le::nodejs:22, nodejs-1:22.23.1-3.module+el9.8.0+24637+e0b636e5.s390x::nodejs:22 +28
  • RHSA-2026:54371 Released 2026-08-12 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.18.0-3.module+el8.10.0+24639+56878497.aarch64::nodejs:24, nodejs-1:24.18.0-3.module+el8.10.0+24639+56878497.ppc64le::nodejs:24, nodejs-1:24.18.0-3.module+el8.10.0+24639+56878497.s390x::nodejs:24 +25

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for ContainersAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Red Hat Ansible Automation Platform 2.1Fixed RHSA-2026:56338
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:56357, RHSA-2026:66003
Red Hat Developer Hub 1.10Fixed RHSA-2026:62851
Red Hat Developer Hub 1.9Fixed RHSA-2026:69248
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:58819
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:54371
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:55601, RHSA-2026:55603
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:62416
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:63103
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:63046
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:63096
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:68754
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:59548
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:59561
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:59554
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:59566
Red Hat OpenShift Service Mesh 3.4Fixed RHSA-2026:59583
multicluster engine for Kubernetes 2.17Fixed RHSA-2026:59593
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:59579
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:59558
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:59559
Not affected: 24 products
  • Confidential Compute Attestation
  • Cryostat 4
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Developer Hub 1.10
  • Red Hat Developer Hub 1.9
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Service Mesh 3.4
  • Red Hat build of Apache Camel for Spring Boot 4
  • multicluster engine for Kubernetes 2.17
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54272
  2. 2026-10-03 Alias added: GHSA-22jq-vg5j-6vgg
  3. 2026-10-16 Fix available: RHSA-2026:55601 · Red Hat
  4. 2026-10-16 Affected versions changed · Red Hat
  5. 2026-10-20 Affected versions changed · Red Hat
  6. 2026-10-24 Affected versions changed · Red Hat
  7. 2026-10-26 Affected versions changed · Red Hat
  8. 2026-10-30 Affected versions changed · Red Hat

References

Advisory 1

Other 4

  • TI-2026-48541 Improper input validation in beaugunderson ip-address CVSS 4.0HIGH 7.7
  • TI-2026-76149 Denial of service in ip-address via many percent characters in input CVSS 4.0MEDIUM 6.3
  • TI-2026-65213 Incorrect comparison in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-65212 Uncontrolled resource consumption in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-65211 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass CVSS 4.0MEDIUM 6.9
  • TI-2026-48543 Improper input validation in beaugunderson ip-address CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences