6.9
Medium
CVE-2026-101910 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
Description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ip-address 10.2 | 10.2.0 → < 10.5.1 | 10.5.1 |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of ip-address
The 9 CVEs of ip-address →
CVE-2026-111997
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall)…
6.3
Medium
CVE-2026-101913
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
6.3
Medium
CVE-2026-101912
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
6.3
Medium
CVE-2026-101911
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
6.3
Medium