5.3
Medium
CVE-2026-42338 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ip-address 10.1 | earliest → < 10.1.1 | 10.1.1 |
| Red Hat OpenShift Service Mesh 2.6 1782287580 | earliest → < 1782287580 | 1782287580 |
| Red Hat OpenShift Service Mesh 3.0 1782201833 | earliest → < 1782201833 | 1782201833 |
| Red Hat OpenShift Service Mesh 3.1 1782201537 | earliest → < 1782201537 | 1782201537 |
| Red Hat OpenShift Service Mesh 3.2 1782201812 | earliest → < 1782201812 | 1782201812 |
| Red Hat OpenShift Service Mesh 3.3 1782201466 | earliest → < 1782201466 | 1782201466 |
| Confidential Compute Attestation | Versions not published | |
| Cryostat 4 | Versions not published | |
| Exploit Intelligence | Versions not published |
Show the 46 other branches Hide the 46 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Migration Toolkit for Containers | Versions not published | |
| Multicluster Engine for Kubernetes | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| Red Hat AMQ Broker 7 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat Build of Podman Desktop | Versions not published | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat Hardened Images | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions not published | |
| Red Hat Developer Hub 1.9 1782761244 | earliest → < 1782761244 | 1782761244 |
| Red Hat Ansible Automation Platform 2.6 1782721130 | earliest → < 1782721130 | 1782721130 |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Developer Hub 1.10 1783448184 | earliest → < 1783448184 | 1783448184 |
| Red Hat OpenShift Dev Spaces 3.29 1782498792 | earliest → < 1782498792 | 1782498792 |
| Red Hat OpenShift Service Mesh 3 1782201833 | earliest → < 1782201833 | 1782201833 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 8 8100020260703140402.6 | earliest → < 8100020260703140402.6d880403 | 8100020260703140402.6d880403 |
| Red Hat Migration Toolkit 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| Red Hat OpenShift Container Platform 4.21 1784713741 | earliest → < 1784713741 | 1784713741 |
| Red Hat OpenShift Container Platform 4.20 1784724699 | earliest → < 1784724699 | 1784724699 |
| Red Hat OpenShift Container Platform 4.22 1784721581 | earliest → < 1784721581 | 1784721581 |
| Red Hat OpenShift Container Platform 4.2 1784724699 | earliest → < 1784724699 | 1784724699 |
| Red Hat Satellite 6.19 1786008041 | earliest → < 1786008041 | 1786008041 |
| Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260804140259 | earliest → < 9060020260804140259.rhel9 | 9060020260804140259.rhel9 |
| Red Hat Migration Toolkit for Containers 1.8 | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Versions not published | |
| Red Hat OpenShift AI 3.4 1787121387 | earliest → < 1787121387 | 1787121387 |
| Red Hat Openshift Data Foundation 4.22 1787061554 | earliest → < 1787061554 | 1787061554 |
| Red Hat Enterprise Linux AI 3.3 1788260620 | earliest → < 1788260620 | 1788260620 |
| Red Hat OpenShift AI 2.25 1787801527 | earliest → < 1787801527 | 1787801527 |
| Red Hat AMQ Broker 7.13.6 | Versions not published | |
| Red Hat AMQ Broker 7.14.1 | Versions not published |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of ip-address
The 9 CVEs of ip-address →
CVE-2026-111997
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall)…
6.3
Medium
CVE-2026-101913
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
6.3
Medium
CVE-2026-101912
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
6.3
Medium
CVE-2026-101911
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
6.3
Medium