Read the docs
TI-2026-65211 Aliases CVE-2026-101910GHSA-2vr4-cq9g-pvrc

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

Priority MEDIUM 64CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Fix Fixed ip-address (beaugunderson): 10.5.1ip-address (npm): 10.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
beaugundersonip-address10.2.0 to before 10.5.110.5.1Patch availableCNA
—ip-address (npm)10.2.0 to before 10.5.110.5.1Patch availableGHSA-2vr4-cq9g-pvrc
  • ip-address Vendorbeaugunderson Affected 10.2.0 to before 10.5.1 Fixed in 10.5.1 Patch available CNA
  • ip-address (npm) Vendor— Affected 10.2.0 to before 10.5.1 Fixed in 10.5.1 Patch available GHSA-2vr4-cq9g-pvrc

Remediation

  • Fix · CNA ip-address (beaugunderson) Fixed in 10.5.1
  • Fix · GHSA-2vr4-cq9g-pvrc ip-address (npm) Fixed in 10.5.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101910
  2. 2026-10-03 Alias added: GHSA-2vr4-cq9g-pvrc
  3. 2026-10-13 Affected versions changed · Red Hat

References

Advisory 1

Other 4

  • TI-2026-48541 Improper input validation in beaugunderson ip-address CVSS 4.0HIGH 7.7
  • TI-2026-39172 ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks CVSS 4.0MEDIUM 6.9
  • TI-2026-76149 Denial of service in ip-address via many percent characters in input CVSS 4.0MEDIUM 6.3
  • TI-2026-65213 Incorrect comparison in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-65212 Uncontrolled resource consumption in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-48543 Improper input validation in beaugunderson ip-address CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences