Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-101912 · GHSA-j6r3-76f7-8jcv

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

Risk score
54/100
CVSS
6.3 v4.0
Exploit chance (30 days)
0.4%
Published
28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits…
Affected
ip-address (npm) <= 10.7.0
Fix
Upgrade ip-address to 10.7.1 or later.
Exploitation
Public proof of concept

Story map

Story map: ip-addressTHE FLAWSTHE FIXCVE-2026-101912IsInSubnet() andisHostInSubnet() compareaddresses of different…CVSS 6.3 · EPSS 0%CVE-2026-101910No classifier recognizes theNAT64 local-use range64:ff9b:1::/48, allowing SSRF…CVSS 6.9 · EPSS 0%CVE-2026-101913Address6.isLinkLocal()recognizes fe80::/64 ratherthan fe80::/10, allowing SSRF…CVSS 6.3 · EPSS 0%CVE-2026-101911Address6 builds a parsediagnostic proportional to theinput with no length bound…CVSS 6.3 · EPSS 0%Upgrade ip-address10.7.1 · 10.5.1or later on your release lineWho is exposedip-address (npm) >= 10.2.0, <=10.5.0YELLOW · PLAN IT INip-addressip-address is a library forparsing and manipulating IPv4and IPv6 addresses inJavaScript. From 10.2.0 until10.5.1, the Address6 isPrivateclassifier in src/ipv6.ts doesnot recognize the NAT64…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-697 (CWE-697)4 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

ip-address: Yellow, plan it in. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decis…

The flaws

  • CVE-2026-101912: IsInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range (CVSS 6.3 · EPSS 0%)
  • CVE-2026-101910: No classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass (CVSS 6.9 · EPSS 0%)
  • CVE-2026-101913: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts (CVSS 6.3 · EPSS 0%)
  • CVE-2026-101911: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process (CVSS 6.3 · EPSS 0%)

The fix

Upgrade ip-address: 10.7.1 · 10.5.1 or later on your release line

Who is exposed: ip-address (npm) >= 10.2.0, <= 10.5.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.3 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
ip-addressnpm<= 10.7.010.7.1

References

Original description

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.

Last activity 28 Sep 2026. Patch Forecast updates every hour.