Read the docs
TI-2026-65213 Aliases CVE-2026-101912GHSA-j6r3-76f7-8jcv

Incorrect comparison in beaugunderson ip-address

Priority HIGH 67CWE-697Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0037 31st percentileScored 2026-11-07
Fix Fixed ip-address (beaugunderson): 10.7.1ip-address (npm): 10.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
beaugundersonip-addressbefore 10.7.110.7.1Patch availableCNA
—ip-address (npm)before 10.7.110.7.1Patch availableGHSA-j6r3-76f7-8jcv
  • ip-address Vendorbeaugunderson Affected before 10.7.1 Fixed in 10.7.1 Patch available CNA
  • ip-address (npm) Vendor— Affected before 10.7.1 Fixed in 10.7.1 Patch available GHSA-j6r3-76f7-8jcv

Remediation

  • Fix · CNA ip-address (beaugunderson) Fixed in 10.7.1
  • Fix · GHSA-j6r3-76f7-8jcv ip-address (npm) Fixed in 10.7.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101912
  2. 2026-10-03 Alias added: GHSA-j6r3-76f7-8jcv
  3. 2026-10-13 Affected versions changed · Red Hat

References

Advisory 1

Other 4

  • TI-2026-48541 Improper input validation in beaugunderson ip-address CVSS 4.0HIGH 7.7
  • TI-2026-39172 ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks CVSS 4.0MEDIUM 6.9
  • TI-2026-76149 Denial of service in ip-address via many percent characters in input CVSS 4.0MEDIUM 6.3
  • TI-2026-65212 Uncontrolled resource consumption in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-65211 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass CVSS 4.0MEDIUM 6.9
  • TI-2026-48543 Improper input validation in beaugunderson ip-address CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences