CVE-2026-101910: falha de média gravidade em beaugunderson ip-address
ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
Publicada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.4%
probabilidade de exploração
0.4%top 69% das CVEs
exploração observada
nãonenhuma fonte reporta
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Produtos afetados
beaugunderson · ip-addressCVEs relacionadas — beaugunderson ip-address
No mesmo produto, das mais perigosas para as menos.
CVE-2026-69192HIGHip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypassEPSS 0.7%CVE-2026-42338MEDIUMip-address: XSS in Address6 HTML-emitting methodsEPSS 0.5%CVE-2026-69198MEDIUMip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksEPSS 0.5%CVE-2026-54272MEDIUMip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checksEPSS 0.4%CVE-2026-101913MEDIUMip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hostsEPSS 0.4%CVE-2026-101912MEDIUMip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its rangeEPSS 0.4%