Read the docs
TI-2026-65214 Aliases CVE-2026-101913GHSA-rpw4-54j3-4h4q

Incorrect comparison in beaugunderson ip-address

Priority MEDIUM 61CWE-697Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Fix Fixed ip-address (beaugunderson): 10.5.1ip-address (npm): 10.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
beaugundersonip-addressbefore 10.5.110.5.1Patch availableCNA
—ip-address (npm)before 10.5.110.5.1Patch availableGHSA-rpw4-54j3-4h4q
  • ip-address Vendorbeaugunderson Affected before 10.5.1 Fixed in 10.5.1 Patch available CNA
  • ip-address (npm) Vendor— Affected before 10.5.1 Fixed in 10.5.1 Patch available GHSA-rpw4-54j3-4h4q

Remediation

  • Fix · CNA ip-address (beaugunderson) Fixed in 10.5.1
  • Fix · GHSA-rpw4-54j3-4h4q ip-address (npm) Fixed in 10.5.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101913
  2. 2026-10-03 Alias added: GHSA-rpw4-54j3-4h4q
  3. 2026-10-13 Affected versions changed · Red Hat

References

Advisory 1

Other 4

  • TI-2026-48541 Improper input validation in beaugunderson ip-address CVSS 4.0HIGH 7.7
  • TI-2026-39172 ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks CVSS 4.0MEDIUM 6.9
  • TI-2026-76149 Denial of service in ip-address via many percent characters in input CVSS 4.0MEDIUM 6.3
  • TI-2026-65213 Incorrect comparison in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-65212 Uncontrolled resource consumption in beaugunderson ip-address CVSS 4.0MEDIUM 6.3
  • TI-2026-65211 ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences