Read the docs
TI-2026-48543 Aliases CVE-2026-69198GHSA-4xrf-jv44-h6hh

Improper input validation in beaugunderson ip-address

Priority MEDIUM 64CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 1 fixed, 21 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.

Summary

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Fix Partial ip-address (beaugunderson): 10.2.2ip-address (npm): 10.2.2Red Hat: 2 advisoriesRed Hat: 1 fixed, 21 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
beaugundersonip-address10.1.1 to before 10.2.210.2.2Patch availableCNA
—ip-address (npm)10.1.1 to before 10.2.210.2.2Patch availableGHSA-4xrf-jv44-h6hh
  • ip-address Vendorbeaugunderson Affected 10.1.1 to before 10.2.2 Fixed in 10.2.2 Patch available CNA
  • ip-address (npm) Vendor— Affected 10.1.1 to before 10.2.2 Fixed in 10.2.2 Patch available GHSA-4xrf-jv44-h6hh

Remediation

  • Fix · CNA ip-address (beaugunderson) Fixed in 10.2.2
  • Fix · GHSA-4xrf-jv44-h6hh ip-address (npm) Fixed in 10.2.2 Advisory →

Red Hat 2 advisories

  • RHSA-2026:50826 Released 2026-08-05 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.1-0.5.2.hum1@aarch64, grafana13.1-13.1.1-0.5.2.hum1@src, grafana13.1-13.1.1-0.5.2.hum1@x86_64
  • RHSA-2026:49401 Released 2026-08-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.6-0.3.hum1@aarch64, grafana12.4-12.4.6-0.3.hum1@src, grafana12.4-12.4.6-0.3.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet: Fix deferred
Migration Toolkit for ContainersAffectedNo fix yet: Fix deferred
Multicluster Engine for KubernetesAffectedNo fix yet: Fix deferred
OpenShift PipelinesAffectedNo fix yet: Fix deferred
OpenShift Service Mesh 3AffectedNo fix yet: Fix deferred
Red Hat AMQ Broker 7AffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Build of Podman DesktopAffectedNo fix yet: Fix deferred
Red Hat Connectivity Link 1AffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred
Self-service automation portal 2AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:49401, RHSA-2026:50826
Not affected: 5 products
  • Cryostat 4
  • Exploit Intelligence
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69198
  2. 2026-10-03 Alias added: GHSA-4xrf-jv44-h6hh
  3. 2026-10-27 Affected versions changed · Red Hat
  4. 2026-11-03 Affected versions changed · Red Hat

References

Other 4

  • TI-2026-48541 Improper input validation in beaugunderson ip-address CVSS 4.0HIGH 7.7
  • TI-2026-39172 ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks CVSS 4.0MEDIUM 6.9
  • TI-2026-76149 Denial of service in ip-address via many percent characters in input CVSS 4.0MEDIUM 6.3
  • TI-2026-65213 Incorrect comparison in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-65212 Uncontrolled resource consumption in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-65211 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences