CVE-2026-101913: medium-severity vulnerability in beaugunderson ip-address
ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.4%
exploitation probability
0.4%top 69% of all CVEs
observed exploitation
nono source reports it
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
beaugunderson · ip-addressRelated CVEs — beaugunderson ip-address
In the same product, most dangerous first.
CVE-2026-69192HIGHip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypassEPSS 0.7%CVE-2026-42338MEDIUMip-address: XSS in Address6 HTML-emitting methodsEPSS 0.5%CVE-2026-69198MEDIUMip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksEPSS 0.5%CVE-2026-54272MEDIUMip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checksEPSS 0.4%CVE-2026-101910MEDIUMip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypassEPSS 0.4%CVE-2026-101912MEDIUMip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its rangeEPSS 0.4%